
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@dcl/inspector
Advanced tools
A React-based scene editor interface for Decentraland, providing a modular architecture for scene editing and manipulation.
A React-based scene editor interface for Decentraland, providing a modular architecture for scene editing and manipulation.
npx @dcl/sdk-commands start --data-layer --port 8001
# Method 1: Development server
git clone https://github.com/decentraland/js-sdk-toolchain.git
cd packages/@dcl/inspector
npm start
# Method 2: From node_modules
npm install @dcl/inspector
npx http-server node_modules/@dcl/inspector/public
http://localhost:3000/?dataLayerRpcWsUrl=ws://127.0.0.1:8001/data-layer
Where http://localhost:3000
is the URL of the Inspector and ws://127.0.0.1:8001/data-layer
is the WebSocket URL of the CLI server.
The Inspector supports two integration approaches:
For development environments using the CLI:
// Connect to CLI's WebSocket server
const inspectorUrl = `http://localhost:3000/?dataLayerRpcWsUrl=ws://127.0.0.1:8001/data-layer`
For web applications embedding the Inspector:
function initRpc(iframe: HTMLIFrameElement) {
const transport = new MessageTransport(window, iframe.contentWindow!)
const storage = new StorageRPC(transport)
// Handle file operations
storage.handle('read_file', async ({ path }) => {
return fs.readFile(path)
})
storage.handle('write_file', async ({ path, content }) => {
await fs.writeFile(path, content)
})
// ... other handlers
return {
storage,
dispose: () => storage.dispose()
}
}
function InspectorComponent() {
const iframeRef = useRef()
const handleIframeRef = useCallback((iframe) => {
if (iframe) {
iframeRef.current = initRpc(iframe)
}
}, [])
useEffect(() => {
return () => iframeRef.current?.dispose()
}, [])
const params = new URLSearchParams({
dataLayerRpcParentUrl: window.location.origin
})
const inspectorUrl = `http://localhost:3000/`
const url = `${inspectorUrl}?${params}`
return <iframe onLoad={handleIframeRef} src={url} />
}
Configure the Inspector through URL parameters or a global object. All configuration options can be set using either method:
type InspectorConfig = {
// Data Layer Configuration
dataLayerRpcWsUrl: string | null // ?dataLayerRpcWsUrl=ws://...
dataLayerRpcParentUrl: string | null // ?dataLayerRpcParentUrl=https://...
// Smart Items Configuration
binIndexJsUrl: string | null // ?binIndexJsUrl=https://...
disableSmartItems: boolean // ?disableSmartItems=true
// Content Configuration
contentUrl: string // ?contentUrl=https://...
// Analytics Configuration
segmentKey: string | null // ?segmentKey=...
segmentAppId: string | null // ?segmentAppId=...
segmentUserId: string | null // ?segmentUserId=...
projectId: string | null // ?projectId=...
}
// Method 1: Global configuration
globalThis.InspectorConfig = {
dataLayerRpcWsUrl: 'ws://127.0.0.1:8001/data-layer',
contentUrl: 'https://builder-items.decentraland.org'
}
// Method 2: URL parameters
// http://localhost:3000/?dataLayerRpcWsUrl=ws://127.0.0.1:8001/data-layer&contentUrl=https://builder-items.decentraland.org&disableSmartItems=true
Configuration options are resolved in the following order:
Run all inspector tests:
make test-inspector
Run specific test files in watch mode:
make test-inspector FILES="--watch packages/@dcl/inspector/src/path/to/some-test.spec.ts"
WebSocket Connection
--data-layer
flagFile System Access
Asset Loading
contentUrl
is correctly configuredDebugging
Testing
For a deeper understanding of the architecture and design decisions:
Apache 2.0
test
FAQs
A React-based scene editor interface for Decentraland, providing a modular architecture for scene editing and manipulation.
The npm package @dcl/inspector receives a total of 1,113 weekly downloads. As such, @dcl/inspector popularity was classified as popular.
We found that @dcl/inspector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.