
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@gooddollar/bridge-contracts
Advanced tools
addBlockchain to tell the validators running the bridge-app which chains to read blocks fromtest/ConsensusMock.sol
import { ethers, upgrades} from "hardhat";
const voting=<registry owner>
const consensus=<fuse consensus contract> ('0x3014ca10b91cb3D0AD85fEf7A3Cb95BCAc9c0f79')
const eventsOnly=true
const rf = await ethers.getContractFactory('BlockHeaderRegistry');
const registery = await upgrades.deployProxy(rf, [voting, consensus, eventsOnly], {
kind: 'uups',
});
console.log('deployed registery to:', registery.address);
await (await registery.addBlockchain(122, 'https://rpc.fuse.io,https://fuse-rpc.gateway.pokt.network')).wait();
await (
await registery.addBlockchain(
42220,
'https://rpc.ankr.com/celo,https://forno.celo.org,https://celo-hackathon.lavanet.xyz/celo/http',
)
).wait();
let initValidators = [<initial validators set>];
let cycleEnd = <fuse consensus cycle end for the initial validator set>;
let reqValidators = [<required validators set>];
let consensusRatio = <percentage 0 - 10>;
let sourceToken = <source bridge token address>
let targetToken = <target bridge token address>
let fees = { maxFee: 10000, minFee: 200, fee: 10 },
let limits = { dailyLimit: 1e10, txLimit: 1e8, accountDailyLimit: 1e9, minAmount: 100000, onlyWhitelisted: false }
let fuseFaucet = <faucet on fuse>
let celoFaucet = <faucet on celo>
let fuseNameService = <nameservice on fuse>
let celoNameService = <nameservice on celo>
const celosigner = new ethers.Wallet(process.env.PRIVATE_KEY || '').connect(
new ethers.providers.JsonRpcProvider('https://forno.celo.org'),
);
const fusesigner = celosigner.connect(ethers.provider);
const tokenBridge = await ethers.getContractFactory('TokenBridge');
const sourceBridge = await tokenBridge
.connect(fusesigner)
.deploy(
initialValidators,
cycleEnd,
reqValidators,
consensusRatio,
sourceToken,
fees,
limits,
fuseFaucet,
fuseNameService,
);
const targetBridge = await tokenBridge
.connect(celosigner)
.deploy(
initialValidators,
cycleEnd,
reqValidators,
consensusRatio,
targetToken,
fees,
limits,
celoFaucet,
celoNameService,
);
//Trusting the bridges...
console.log('deployed bridges...');
await (
await sourceBridge.setSourceBridges([targetBridge.address], [await celosigner.provider.getBlockNumber()])
).wait();
await (
await targetBridge.setSourceBridges([sourceBridge.address], [await fusesigner.provider.getBlockNumber()])
).wait();
bridgeTo(recipient,targetChainId,amount)FAQs
## Contracts
The npm package @gooddollar/bridge-contracts receives a total of 97 weekly downloads. As such, @gooddollar/bridge-contracts popularity was classified as not popular.
We found that @gooddollar/bridge-contracts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.