
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@huddly/camera-proto
Advanced tools
An npm package describing the protobuf api for huddly network cameras
The .proto format: https://developers.google.com/protocol-buffers/docs/proto3
Style guide: https://developers.google.com/protocol-buffers/docs/style
Guides to use the interface in C++, python etc. is found in the menu to the left in the above links.
Important note about enums:
The simplest way to release and deploy NuGet packages is to use the GitHub actions workflow specified in the next section. NuGet packages must be signed and the HSM signing certificate is not availabe offline.
First decide if you wish to create a stable release, or a pre-release.
Go to the actions pane on GitHub -> select the 'Compile and publish' workflow -> 'Run workflow' -> select the appropriate branch
Go to 'Releases' on GitHub -> Draft a new release -> Choose a tag, just create a new tag that follows the convention (vX.Y.Z) -> Check 'Set as the latest release' -> Publish release
Affected projects when doing changes to this repository and/or making new releases include:
'AZURE_TENANT_ID' = 'a6e177ed-014c-43fa-b395-63aaf1204e45'
'AZURE_PROD_SUBSCRIPTION_ID' = '253195fd-b226-4ce4-8a37-68d174c5d335'
'AZURE_HSM_CERTIFICATE_VAULT_URL' = 'https://hsm-ev-certificates-we.vault.azure.net/'
'AZURE_HSM_CODE_SIGN_CERT_NAME' = 'huddly-ev-code-sign'
Name: 'falcon-interface_GitHub_Actions'
Expires: 2025-11-5
TenantId: 'a6e177ed-014c-43fa-b395-63aaf1204e45'
ClientId: 'FALCON_INTERFACE_AZURE_CLIENT_ID' = '71d20749-11b7-4fe0-b224-1df3f1350942'
ClientSecret: 'FALCON_INTERFACE_AZURE_CLIENT_SECRET' (Repository Secret)
JsonSecret: 'FALCON_INTERFACE_AZURE_CREDENTIALS' (Repository Secret)
hsm-ev-certificates-we
key valult, huddly-ev-code-sign
certificate
Role: 'Key Vault Reader'
Scope: '/subscriptions/253195fd-b226-4ce4-8a37-68d174c5d335/resourceGroups/code-signing-certificates'
hsm-ev-certificates-we
key valult, huddly-ev-code-sign
certificate
Role: 'Key Vault Crypto User'
Scope: '/subscriptions/253195fd-b226-4ce4-8a37-68d174c5d335/resourceGroups/code-signing-certificates/providers/Microsoft.KeyVault/vaults/hsm-ev-certificates-we'
https://github.com/Huddly/sdk-dotnet/wiki/EV-Code-Signing
TODO: Improve documentation!
Shared secret: HUDDLY_GITHUB_PACKAGE_TOKEN
Repo secret: FALCON_INTERFACE_NUGET_KEY
conan create . -r conan -pr:h x86_64-gcc-11-2 --user huddly -pr:b x86_64-gcc-11-2
Below you can see the different markups that are used to ignore proto code that is specific to huddly. When generating the google proto file, all the code that has been tagged with the markup lines will not be present.
This markup will ignore the whole block that follows after the markup line. It will also ignore any nested blocks within the ignore block.
This markup will ignore the next line that follows after the markup line.
NOTE: There is a bug with ts-protoc-gen
dependency where the generated ts file has the wrong import (imports "grpc" instead of "@grpc/grpc-js"). For now, this issue/file needs to be update manually before publishing the package.
Making a npm release is done manually by one of the developers with publishing access to our huddly organization account on npmjs. The following procedure should be followed when wanting to make a new npm package release:
npm version [patch|minor|major]
to bump it through npmnpm run publish-package
. NOTE Running this command requires you to be logged in to npmjs through your terminal windows with the huddly account.modes {
mode: "speaker-centric"
}
modes {
mode: "default"
}
FAQs
An npm package describing the protobuf api for huddly network cameras
The npm package @huddly/camera-proto receives a total of 4 weekly downloads. As such, @huddly/camera-proto popularity was classified as not popular.
We found that @huddly/camera-proto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.