
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@chainsafe/chainbridge-contracts
Advanced tools
[](https://coveralls.io/github/ChainSafe/chainbridge-solidity?branch=master)
ChainBridge uses Solidity smart contracts to enable transfers to and from EVM compatible chains. These contracts consist of a core bridge contract (Bridge.sol) and a set of handler contracts (ERC20Handler.sol, ERC721Handler.sol, and GenericHandler.sol). The bridge contract is responsible for initiating, voting on, and executing proposed transfers. The handlers are used by the bridge contract to interact with other existing contracts.
Read more here.
A CLI to deploy and interact with these contracts can be found here.
Requires nodejs and npm.
make install-deps: Installs truffle and ganache globally, fetches local dependencies. Also installs abigen from go-ethereum.
make bindings: Creates go bindings in ./build/bindings/go
PORT=<port> SILENT=<bool> make start-ganache: Starts a ganache instance, default PORT=8545 SILENT=false
QUIET=<bool> make start-geth: Starts a geth instance with test keys
PORT=<port> make deploy: Deploys all contract instances, default PORT=8545
make test: Runs truffle tests.
make compile: Compile contracts.
We take all security issues seriously, if you believe you have found a security issue within a ChainSafe project please notify us immediately. If an issue is confirmed, we will take all necessary precautions to ensure a statement and patch release is made in a timely manner.
Please email us a description of the flaw and any related information (e.g. reproduction steps, version) to security at chainsafe dot io.
FAQs
[](https://coveralls.io/github/ChainSafe/chainbridge-solidity?branch=master)
The npm package @chainsafe/chainbridge-contracts receives a total of 5 weekly downloads. As such, @chainsafe/chainbridge-contracts popularity was classified as not popular.
We found that @chainsafe/chainbridge-contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.