
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@graphprotocol/address-book
Advanced tools
Contract addresses for The Graph Protocol. This package provides JSON files containing contract addresses for different networks.
npm install @graphprotocol/address-book
# or
pnpm install @graphprotocol/address-book
// CommonJS
const horizonAddresses = require('@graphprotocol/address-book/horizon/addresses.json')
const subgraphServiceAddresses = require('@graphprotocol/address-book/subgraph-service/addresses.json')
// ES Modules
import horizonAddresses from '@graphprotocol/address-book/horizon/addresses.json'
import subgraphServiceAddresses from '@graphprotocol/address-book/subgraph-service/addresses.json'
The addresses are organized by chain ID and contract name:
{
"1337": {
"Controller": {
"address": "0x...",
"proxy": "transparent",
"proxyAdmin": "0x...",
"implementation": "0x..."
}
}
}
This package uses symlinks to stay in sync with the source address files. On first install, symlinks are automatically created.
This package uses a special workflow to ensure address files are included in the published package:
Development: The package uses symlinks to stay in sync with source address files:
src/horizon/addresses.json
→ symlink to ../../../horizon/addresses.json
src/subgraph-service/addresses.json
→ symlink to ../../../subgraph-service/addresses.json
Publishing: npm doesn't include symlinks in packages, so we automatically handle this:
npm publish
Automatic execution:
prepublishOnly
- Copies actual files to replace symlinkspostpublish
- Restores symlinks for developmentIf publishing fails, the postpublish
script may not run, leaving copied files instead of symlinks. To restore symlinks manually:
pnpm restore-symlinks
All symlink management is handled automatically during successful publishes.
FAQs
Contract addresses for The Graph Protocol
We found that @graphprotocol/address-book demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 23 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.