
Research
SAP CAP npm Packages Hit by Mini Shai-Hulud Supply Chain Attack
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.
@chainsafe/chainbridge-contracts
Advanced tools
[](https://coveralls.io/github/ChainSafe/chainbridge-solidity?branch=master)
ChainBridge uses Solidity smart contracts to enable transfers to and from EVM compatible chains. These contracts consist of a core bridge contract (Bridge.sol) and a set of handler contracts (ERC20Handler.sol, ERC721Handler.sol, and GenericHandler.sol). The bridge contract is responsible for initiating, voting on, and executing proposed transfers. The handlers are used by the bridge contract to interact with other existing contracts.
Read more here.
A CLI to deploy and interact with these contracts can be found here.
Requires nodejs and npm.
make install-deps: Installs truffle and ganache globally, fetches local dependencies. Also installs abigen from go-ethereum.
make bindings: Creates go bindings in ./build/bindings/go
PORT=<port> SILENT=<bool> make start-ganache: Starts a ganache instance, default PORT=8545 SILENT=false
QUIET=<bool> make start-geth: Starts a geth instance with test keys
PORT=<port> make deploy: Deploys all contract instances, default PORT=8545
make test: Runs truffle tests.
make compile: Compile contracts.
We take all security issues seriously, if you believe you have found a security issue within a ChainSafe project please notify us immediately. If an issue is confirmed, we will take all necessary precautions to ensure a statement and patch release is made in a timely manner.
Please email us a description of the flaw and any related information (e.g. reproduction steps, version) to security at chainsafe dot io.
FAQs
[](https://coveralls.io/github/ChainSafe/chainbridge-solidity?branch=master)
The npm package @chainsafe/chainbridge-contracts receives a total of 55 weekly downloads. As such, @chainsafe/chainbridge-contracts popularity was classified as not popular.
We found that @chainsafe/chainbridge-contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.

Research
/Security News
Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.