
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@caravan/bip32
Advanced tools
Package for working with bip32 and derivative objects like extended public keys
secureSecretPathGenerates a random BIP32 path of a given depth. The randomness is generated using the Node.js crypto module. This can be used for blinding an xpub. The function ensures that the depth is an integer and less than 32.
combineBip32PathsGiven two BIP32 paths, combine them into a single path. Useful for creating blinded xpubs when you have the source path and want to append the randomly generated one
getUnmaskedPathGiven a derivation and a global xpub, return the unmasked path that can be used to derive the child pubkey from the global xpub. This is useful when you have a child xpub (e.g. a blinded xpub) derived from a masked xpub and you need to generate the full, unmasked path.
getRelativeBip32SequenceA utility to use when you have a parent and child bip32 paths and want the "relative" sequence (the path elements from the child that are added on to the parent).
getRandomChildXpubGiven a source xpub, derive a child xpub at a random path using secureSecretPath defaults to depth 4. Useful for creating blinded xpubs or generating random child xpubs (e.g. strands)
getMaskedKeyOriginDerive a masked key origin from an xpub. Useful for generating descriptors and wallet configurations for keys that don't need to have their key origin info revealed. Bip32 path will use all 0s for the depth of the given xpub and the root fingerprint will be set to the parent fingerprint of the xpub
isValidChildPubKeyWhen you have a global xpub from a PSBT, it's useful to make sure that a child pubkey can be derived from that psbt. Sometimes the pubkey derivation comes from a masked and/or blinded xpub. So we need to combine the child derivation with the global and confirm that the pubkey can be derived from that source
setXpubNetworkSets and updates serialization of xpub for a network accordingly.
getBlindedXpubGiven a source xpub, derive a blinded xpub at a random path. Will target 128 bits of entropy for the path with a depth of 4.
FAQs
Package for working with bip32 and derivative objects like extended public keys
We found that @caravan/bip32 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.