
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@hashgraph/hedera-identify-snap
Advanced tools
This repository contains code for Identify Snap that offers various features such as configuring hedera account, getting current did method, getting DID, resolving DID, getting Verifiable Credentials, creating Verifiable Credentials out of some arbitary JSON object, generating Verifiable Presentations from Verifiable Credentials and verifying VCs and verifying VPs. Refer to the Identify Snap Wiki for more info on how the snap works and how to integrate it into your own application.
MetaMask Snaps is a system that allows anyone to safely expand the capabilities of MetaMask. A snap is a program that we run in an isolated environment that can customize the wallet experience.
Linting, static analysis and testing via Jest are configured via Github Actions in the repository. Replication of these steps locally is covered below.
yarn install && yarn start
Run yarn test to run the tests once.
Run yarn lint to run the linter, or run yarn lint:fix to run the linter and fix any automatically fixable issues.
Note that linting currently will run through ESLint and Prettier rules.
The project follows the same release process as the other libraries in the MetaMask organization. The GitHub
Actions action-create-release-pr
and action-publish-release are used to automate the release
process; see those repositories for more information about how they work.
Choose a release version.
If this release is backporting changes onto a previous release, then ensure there is a major version branch for that
version (e.g. 1.x for a v1 backport release).
v1.0.2 release, you'd want to ensure there was a 1.x branch that was set to the v1.0.1 tag.Trigger
the workflow_dispatch
event manually for
the Create Release Pull Request action to create the release PR.
action-create-release-pr workflow to
create the release PR.Update the changelog to move each change entry into the appropriate change category (See here for the full list of change categories, and the correct ordering), and edit them to be more easily understood by users of the package.
yarn auto-changelog validate --rc to check that the changelog is correctly formatted.Review and QA the release.
Squash & Merge the release.
action-publish-release workflow to tag
the final release commit and publish the release on GitHub.Publish the release on npm.
npm publish --dry-run to examine the release contents to ensure the correct files are included. Compare to
previous releases if necessary (e.g. using https://unpkg.com/browse/[package name]@[package version]/).npm publish.Babel is used for transpiling TypeScript to JavaScript, so when building with the CLI,
transpilationMode must be set to localOnly (default) or localAndDeps.
For the global wallet type to work, you have to add the following to your tsconfig.json:
{
"files": ["./node_modules/@metamask/snap-types/global.d.ts"]
}
FAQs
A snap for managing Decentralized Identifiers(DIDs)
We found that @hashgraph/hedera-identify-snap demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.