
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@dynamic-labs/wallet-book
Advanced tools
Simply add an entry to firstPartyWalletsData
in packages/wallet-book/src/build/sources/firstParty/index.ts
and Compile & Publish
For example:
argentx: {
brand: {
alt: 'Argent Wallet',
primaryColor: '#FF875B',
spriteId: 'argentx',
},
desktop: {
chromeId: 'dlcobpjiigpikoobohmabehhmhfoodbb',
firefoxId: 'argent-x',
},
name: 'Argent X',
injectedConfig: [
{
chain: 'EVM',
extensionLocators:
}
]
},
Required fields:
brand
alt
primaryColor
spriteId
- The id used in the iconic svgname
Refer to WalletRecordsSchema
for more schema options
Similar to adding first party wallets, we add another key, injectedConfig
to the wallet object.
...
injectedConfig: [
{
chain: 'EVM',
extensionLocators: [
{ flag: 'isOkxWallet', value: true },
{ flag: 'isOkexWallet', value: true }
],
windowLocations: ['okxwallet']
}
],
name: 'OKX'
ethereum/src/injected/
or solana/src/injected/
. The basic file should follow this form:export class <NameOfConnector> extends InjectedWalletBase {
override name = '<Name Here>';
override walletConnectorFallback = true; // only specified on evm wallet connectors
constructor(props: EthWalletConnectorOpts) {
super(props);
this.wallet = findWalletBookWallet(this.walletBook, this.key);
}
// override the methods you need below
override async getAddress() {
...
}
}
fetchInjectedWalletConnectors.ts
for the respective network package (etherem/solana/...
) and add the new InjectedWalletBase class to injectedWalletOverrides
and the key (normalized name) to the filterInjectedWalletKeyOverrides
IF the new wallet is also in wallletconnect.json
: make sure that the key used in firstParty/index.ts
is the same
as the value from walletconnect.json
as to inherit the properties from that wallet definition.windowLocations
map to window.<value from windowLocations>
. i.e. okxwallet
means window.okxwallet
. The values can be a nested path that is dot delimited. If the wallet lives under window.ethereum
or window.ethereum.providers
, those window locations are imported by default.[{ flag: 'isOkxWallet', value: false }, ...]
to the extensionLocators under the metamask
key in firstParty.walletconnect.json
), make sure to add: filterFromWalletConnect: true
as a sibling to injectedConfig
which will filter the wallet from the wallet connect connectors list and use wallet connect as fallback.[ ]: If this change adds a new file to the injected folder, add the wallet key to the walletBookFallbackList
in packages/wallet-book/src/build/index.ts
[ ]: If the name is changing in walletbook, make sure that if there is no new file in the injected/
folder, you make sure at least the shortName
normalizes down to the wallet key
myawesomenewwallet: {
...
injectedConfig: { ... },
shortName: 'My Awesome New Wallet', // maps down to the key if you lowercase and remove special characters and spaces
name: 'Awesome Wallet' // this will be displayed in the wallet list and can be changed as long as the `shortName` normalizes to the key
}
NOTE:
Refer to injectedConfigSchema
for the schema options
The compiled json is stored in packages/wallet-book/wallet-book.json
. When the file is updated
and merged to main it will be published to S3 automatically.
Simply, make any changes that you need and:
npx nx compile wallet-book
wallet-book.json
FAQs
## Updating Wallet Book
The npm package @dynamic-labs/wallet-book receives a total of 20,147 weekly downloads. As such, @dynamic-labs/wallet-book popularity was classified as popular.
We found that @dynamic-labs/wallet-book demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.