
Security News
Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
@chainsafe/chainbridge-contracts
Advanced tools
[](https://coveralls.io/github/ChainSafe/chainbridge-solidity?branch=master)
ChainBridge uses Solidity smart contracts to enable transfers to and from EVM compatible chains. These contracts consist of a core bridge contract (Bridge.sol) and a set of handler contracts (ERC20Handler.sol, ERC721Handler.sol, and GenericHandler.sol). The bridge contract is responsible for initiating, voting on, and executing proposed transfers. The handlers are used by the bridge contract to interact with other existing contracts.
Read more here.
A CLI to deploy and interact with these contracts can be found here.
Requires nodejs
and npm
.
make install-deps
: Installs truffle and ganache globally, fetches local dependencies. Also installs abigen
from go-ethereum
.
make bindings
: Creates go bindings in ./build/bindings/go
PORT=<port> SILENT=<bool> make start-ganache
: Starts a ganache instance, default PORT=8545 SILENT=false
QUIET=<bool> make start-geth
: Starts a geth instance with test keys
PORT=<port> make deploy
: Deploys all contract instances, default PORT=8545
make test
: Runs truffle tests.
make compile
: Compile contracts.
We take all security issues seriously, if you believe you have found a security issue within a ChainSafe project please notify us immediately. If an issue is confirmed, we will take all necessary precautions to ensure a statement and patch release is made in a timely manner.
Please email us a description of the flaw and any related information (e.g. reproduction steps, version) to security at chainsafe dot io.
FAQs
[](https://coveralls.io/github/ChainSafe/chainbridge-solidity?branch=master)
We found that @chainsafe/chainbridge-contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.