
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@go1d/retriever
Advanced tools
Content Discovery #team-content-discovery
npm ci
npm run dev:setup
pushd ../prospector && npm link ../retriever/build && popd
npm run dev:link ../prospector
npm run dev:watch
npm run storybook
npm ci
npm run lingui:extract
npm run lingui:compile
npm run test:i18n -- --coverage
For who use Windows you can follow this: Update package.json of schema:update script to set QUERY_ENDPOINT=https://api.qa.go1.cloud/query & sh ./tools/updateSchema.sh
Use 1query on QA environment:
export QUERY_ENDPOINT=https://api.qa.go1.cloud/query && npm run schema:update
Use 1query on your local machine:
```sh
export QUERY_ENDPOINT=http://localhost:6382 && npm run schema:update
In order to upgrade to latest shared packages which means we need to upgrade to react@^17.x
however this package react-apollo@(2|3)x
requires react@^16.x
so we really need to upgrade this package although looks like there's no issue right now based on content-selector
consumes this package without issues.
To work with new npm checking deps, we have to hack around by using legacy peer deps in .npmrc
so this setting should be removed as soon as this package got updated to support react@^17
.
FAQs
Explore UI
The npm package @go1d/retriever receives a total of 18 weekly downloads. As such, @go1d/retriever popularity was classified as not popular.
We found that @go1d/retriever demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.