Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@exodus/bitcoinjs-lib-zcash
Advanced tools
@exodus/bitcoinjs-lib-zcash
)BitcoinJS, forked to support Zcash. Does not support z-addresses, only t-addresses.
All-new test suite; not nearly as exhaustive as bitcoinjs-lib
's suite. May be bugs in parts of code not used by Exodus or the tests.
Original bitcoinjs-lib
README below:
The pure JavaScript Bitcoin library for node.js and browsers. Estimated to be in use by over 15 million wallet users and is the backbone for almost all Bitcoin web wallets in production today.
If you are thinking of using the master branch of this library in production, stop. Master is not stable; it is our development branch, and only tagged releases may be classified as stable.
npm install bitcoinjs-lib
var bitcoin = require('bitcoinjs-lib')
If you're familiar with how to use browserify, ignore this and proceed normally. These steps are advisory only, and may not be suitable for your application.
Browserify is assumed to be installed for these steps.
For your project, create an index.js
file
let bitcoin = require('bitcoinjs-lib')
// your code here
function myFunction () {
return bitcoin.ECPair.makeRandom().toWIF()
}
module.exports = {
myFunction
}
Now, to compile for the browser:
browserify index.js --standalone foo > app.js
You can now put <script src="app.js" />
in your web page, using foo.myFunction
to create a new Bitcoin private key.
NOTE: If you uglify the javascript, you must exclude the following variable names from being mangled: BigInteger
, ECPair
, Point
.
This is because of the function-name-duck-typing used in typeforce.
Example:
uglifyjs ... --mangle reserved=['BigInteger','ECPair','Point']
NOTE: This library tracks Node LTS features, if you need strict ES5, use --transform babelify
in conjunction with your browserify
step (using an es2015
preset).
NOTE: If you expect this library to run on an iOS 10 device, ensure that you are using buffer@5.0.5 or greater.
Type declarations for Typescript are available for version ^3.0.0
of the library.
npm install @types/bitcoinjs-lib
You can now use bitcoinjs-lib
as a typescript compliant library.
import { HDNode, Transaction } from 'bitcoinjs-lib'
For VSCode (and other editors), users are advised to install the type declarations, as Intellisense uses that information to help you code (autocompletion, static analysis).
Report any typescript related bugs at @dlebrecht DefinitelyTyped fork, submit PRs to DefinitelyTyped
Definitions for Flow typechecker are available in flow-typed repository.
You can either download them directly from the repo, or with the flow-typed CLI
# npm install -g flow-typed
$ flow-typed install -f 0.27 bitcoinjs-lib@2.2.0 # 0.27 for flow version, 2.2.0 for bitcoinjs-lib version
The definitions are complete and up to date with version 2.2.0. The definitions are maintained by @runn1ng.
The below examples are implemented as integration tests, they should be very easy to understand. Otherwise, pull requests are appreciated. Some examples interact (via HTTPS) with a 3rd Party Blockchain Provider (3PBP).
If you have a use case that you feel could be listed here, please ask for it!
We are always accepting of pull requests, but we do adhere to specific standards in regards to coding style, test driven development and commit messages.
Please make your best effort to adhere to these when contributing to save on trivial corrections.
npm test
npm run-script coverage
FAQs
Client-side Zcash JavaScript library
We found that @exodus/bitcoinjs-lib-zcash demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 98 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.