
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@cartesi/demo
Advanced tools
:warning: The Cartesi team keeps working internally on the next version of this repository, following its regular development roadmap. Whenever there's a new version ready or important fix, these are published to the public source tree as new releases.
The Cartesi Demo is a showcase for a simple dapp that uses all Cartesi Modules. It consists of a very simple dapp that triggers a Verification Game (VG) between two parties (Alice and Bob). Alice disputes Bob's result for the demo dapp execution and runs the dapp correctly. Bob, on the other hand, simulates a party that is not behaving correctly and executes the dapp in a defective environment in which the clock of the Cartesi Machine saturates at a determined cycle.
This repository contains everything that is needed to generate docker images for all the Cartesi Modules and two high level scripts to build everything from scratch and run the demo.
$ git clone --recursive git@github.com:cartesi/demo.git
$ cd demo
$ ./prepare_demo.sh
This script builds multiple docker images so it takes a while to complete
$ byobu
$./deploy
From here the script spawns multiple terminal windows and starts:
The demo ends when the Verification Game is concluded and arbitrates Alice as the winner.
In this section we further detail what's going on as a whole and under each module during the preparation and execution of the demo.
The prepare_demo.sh script automates most of the time consuming preparation tasks needed to execute the demo:
The deploy script starts all the Cartesi modules for two parties (Alice and Bob), the Ganache node that performs the blockchain tasks and does some additional setup so the whole demo can execute. Here is a more detailed description of what is performed in the deploy script:
The Verification Game starts. Both parties agree on the Merkle tree root hash of the initial state of their Cartesi machines, as both were initialized with the same configuration, but they don't agree on the final hash.
The dispute starts with the partition phase, in which Alice and Bob engage in an n-ary search (where n=10 in this demo) to identify the cycle in which their execution of the sample computation diverge. Once they identify the exact cycle where they agree on the Merkle tree root hash of the Cartesi machine state but diverge on the state after the execution of that cycle's instruction (that is, they don't agree on the Merkle tree root hash of the Cartesi machine state for cycle + 1), it's time for Alice to submit to the memory manager contract in the blockchain her off-chain state accesses that happen in the transaction of the Cartesi machine state from the last cycle both parties agree to the cycle they do not.
Once the state accesses are submitted, the instruction that transitions the state of the Cartesi machine from the cycle both parties agree to the one they don't is then executed by the on-chain machine step implementation. If at any point the state accesses from the blockchain step implementation diverge from the state accesses submitted by Alice, Alice loses the dispute, if the execution ends with no divergences, Alice wins (in this demo, there are no divergences as Alice is the correct party and Bob is the one misbehaving).
Thank you for your interest in Cartesi! Head over to our Contributing Guidelines for instructions on how to sign our Contributors Agreement and get started with Cartesi!
Please note we have a Code of Conduct, please follow it in all your interactions with the project.
The demo repository and all contributions are licensed under APACHE 2.0. Please review our LICENSE file.
FAQs
Cartesi Demo DApp
We found that @cartesi/demo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.