
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@cipherstash/jseql-ffi
Advanced tools
This project was bootstrapped by [create-neon](https://www.npmjs.com/package/create-neon).
This project was bootstrapped by create-neon.
Building requires a supported version of Node and Rust.
To run the build, run:
$ npm run build
This command uses the @neon-rs/cli utility to assemble the binary Node addon from the output of cargo
.
After building jseql-ffi
, you can explore its exports at the Node console.
CS_CLIENT_ID
and CS_CLIENT_KEY
must be set in your environment for the call to newClient()
to succeed.
$ npm i
$ npm run build
$ node
> const addon = require(".");
> const client = await addon.newClient();
> const ciphertext = await addon.encrypt(client, "plaintext", "column_name");
> const plaintext = await addon.decrypt(client, ciphertext);
> console.log({ciphertext, plaintext});
In the project directory, you can run:
npm run build
Builds the Node addon (index.node
) from source, generating a release build with cargo --release
.
Additional cargo build
arguments may be passed to npm run build
and similar commands. For example, to enable a cargo feature:
npm run build -- --feature=beetle
npm run debug
Similar to npm run build
but generates a debug build with cargo
.
npm run cross
Similar to npm run build
but uses cross-rs to cross-compile for another platform. Use the CARGO_BUILD_TARGET
environment variable to select the build target.
npm run release
Initiate a full build and publication of a new patch release of this library via GitHub Actions.
npm run dryrun
Initiate a dry run of a patch release of this library via GitHub Actions. This performs a full build but does not publish the final result.
npm test
Runs the unit tests by calling cargo test
. You can learn more about adding tests to your Rust code from the Rust book.
The directory structure of this project is:
jseql-ffi/
├── Cargo.toml
├── README.md
├── lib/
├── src/
| ├── index.mts
| └── index.cts
├── crates/
| └── jseql-ffi/
| └── src/
| └── lib.rs
├── platforms/
├── package.json
└── target/
Entry | Purpose |
---|---|
Cargo.toml | The Cargo manifest file, which informs the cargo command. |
README.md | This file. |
lib/ | The directory containing the generated output from tsc. |
src/ | The directory containing the TypeScript source files. |
index.mts | Entry point for when this library is loaded via ESM import syntax. |
index.cts | Entry point for when this library is loaded via CJS require . |
crates/ | The directory tree containing the Rust source code for the project. |
lib.rs | Entry point for the Rust source code. |
platforms/ | The directory containing distributions of the binary addon backend for each platform supported by this library. |
package.json | The npm manifest file, which informs the npm command. |
target/ | Binary artifacts generated by the Rust build. |
Releases are handled by GitHub Actions using a workflow_dispatch
event trigger.
The release workflow was generated by Neon.
The release workflow is responsible for:
@cipherstash/jseql-ffi
package as well as the native packages for each platform (e.g. @cipherstash/jseql-ffi-darwin-arm64
).To perform a release:
npm version
.
Select "custom" in the dropdown and fill in the "Custom version" text box if you want to use a semver string instead of the shorthand (patch, minor, major, etc.).Note that we currently don't have any automation around release notes or a changelog. However, you can add release notes after running the workflow by editing the release on GitHub.
Learn more about:
FAQs
This project was bootstrapped by [create-neon](https://www.npmjs.com/package/create-neon).
The npm package @cipherstash/jseql-ffi receives a total of 52 weekly downloads. As such, @cipherstash/jseql-ffi popularity was classified as not popular.
We found that @cipherstash/jseql-ffi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.