
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@decentralchain/ledger
Advanced tools
DecentralChain Ledger hardware wallet integration library.
Communicate with Ledger Nano S/X devices to derive public keys and sign transactions securely on the hardware device. Supports WebUSB, Web Bluetooth, and Node HID transports.
Part of the DecentralChain SDK.
@ledgerhq/hw-transport-webusb, @ledgerhq/hw-transport-web-ble, etc.)npm install @decentralchain/ledger
You also need a Ledger transport package:
npm install @ledgerhq/hw-transport-webusb
import { DCCLedger } from '@decentralchain/ledger';
import TransportWebUSB from '@ledgerhq/hw-transport-webusb';
const ledger = new DCCLedger({ transport: TransportWebUSB });
await ledger.tryConnect();
// Get public key and address for account 0
const user = await ledger.getUserDataById(0);
console.log(user.address, user.publicKey);
// Sign a transaction
const signature = await ledger.signTransaction(0, {
dataBuffer: transactionBytes,
dataType: 4,
dataVersion: 2,
});
new DCCLedger(options)Create a new Ledger integration instance.
| Option | Type | Default | Description |
|---|---|---|---|
transport | LedgerTransportFactory | — | Required. A @ledgerhq/hw-transport-* class |
debug | boolean | false | Enable binary exchange logging |
openTimeout | number | — | Connection timeout (ms) |
listenTimeout | number | — | Listen request timeout (ms) |
exchangeTimeout | number | — | Exchange call timeout (ms) |
networkCode | number | 76 | DCC network code (76 = mainnet) |
tryConnect(): Promise<void>Connect (or reconnect) to the Ledger device.
disconnect(): Promise<void>Close the active transport connection.
probeDevice(): Promise<boolean>Returns true if the device is connected and the DCC app is open.
getUserDataById(id: number): Promise<User>Derive wallet data for an account index.
Returns { id, path, address, publicKey, statusCode }.
getVersion(): Promise<number[]>Query the installed DCC application version ([major, minor, patch]).
getPaginationUsersData(from: number, limit: number): Promise<User[]>Retrieve wallet data for a range of consecutive account indices.
signTransaction(userId, data): Promise<string>Sign a transaction. The Ledger device displays parsed transaction details.
signOrder(userId, data): Promise<string>Sign an exchange order.
signSomeData(userId, data): Promise<string>Sign arbitrary data bytes (device shows raw data warning).
signRequest(userId, data): Promise<string>Sign a request payload.
signMessage(userId, message): Promise<string>Sign an ASCII text message.
All signing methods return a Base58-encoded signature string.
getLastError(): unknownReturn the last error from a Ledger operation, or null.
getPathById(id: number): stringBuild the BIP-44 derivation path for an account index.
.node-version)git clone https://github.com/Decentral-America/ledger.git
cd ledger
npm install
| Command | Description |
|---|---|
npm run build | Build distribution files |
npm test | Run tests with Vitest |
npm run test:watch | Tests in watch mode |
npm run test:coverage | Tests with V8 coverage |
npm run typecheck | TypeScript type checking |
npm run lint | Biome lint |
npm run lint:fix | Biome lint with auto-fix |
npm run format | Format with Biome |
npm run validate | Full CI validation pipeline |
npm run bulletproof | Format + lint fix + typecheck + test |
npm run bulletproof:check | CI-safe: check format + lint + tc + test |
| Package | Description |
|---|---|
@decentralchain/signature-adapter | Multi-provider signing adapter |
@decentralchain/signer | Transaction signing orchestrator |
@decentralchain/transactions | Transaction builders and signers |
@decentralchain/ts-lib-crypto | Cryptographic primitives |
See CONTRIBUTING.md.
To report a vulnerability, see SECURITY.md.
MIT — Copyright (c) DecentralChain
FAQs
DecentralChain Ledger hardware wallet integration library
We found that @decentralchain/ledger demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.