Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The iov-cli
executable is available via npm. We recommend local installations
to your demo project. If you don't have one yet, just
mkdir iov-cli-installation && cd iov-cli-installation && yarn init -y
.
$ yarn add @iov/cli --dev
$ ./node_modules/.bin/iov-cli
$ npm install @iov/cli --save-dev
$ ./node_modules/.bin/iov-cli
$ yarn global add @iov/cli
$ iov-cli
$ npm install -g @iov/cli
$ iov-cli
@iov/cli
and run iov-cli
as shown above> const profile = new UserProfile();
> const signer = new MultiChainSigner(profile);
> const { connection } = await signer.addChain(createBnsConnector("ws://localhost:23456"));
> const chainId = connection.chainId;
> chainId
'test-chain-esuZ1V'
> const wallet = profile.addWallet(Ed25519HdWallet.fromMnemonic("degree tackle suggest window test behind mesh extra cover prepare oak script"));
> profile.getIdentities(wallet.id)
[]
> const faucet = await profile.createIdentity(wallet.id, chainId, HdPaths.iov(0))
> faucet.pubkey
{ algo: 'ed25519',
data:
Uint8Array [
224,
42, ...
> profile.setIdentityLabel(faucet, "blockchain of value faucet")
> profile.getIdentities(wallet.id)
[ { chainId: 'test-chain-esuZ1V',
pubkey: { algo: 'ed25519', data: [Uint8Array] } } ]
> const faucetAddress = signer.identityToAddress(faucet);
> faucetAddress
'tiov1k898u78hgs36uqw68dg7va5nfkgstu5z0fhz3f'
> (await connection.getAccount({ address: faucetAddress })).balance
> const recipient = await profile.createIdentity(wallet.id, chainId, HdPaths.iov(1));
> const recipientAddress = signer.identityToAddress(recipient);
> .editor
const sendTx = await connection.withDefaultFee<SendTransaction>({
kind: "bcp/send",
chainId: faucet.chainId,
sender: faucetAddress,
recipient: recipientAddress,
memo: "My first transaction",
amount: {
quantity: "33123456789",
fractionalDigits: 9,
tokenTicker: "CASH" as TokenTicker,
},
}, faucetAddress);
^D
> await signer.signAndPost(faucet, sendTx);
> (await connection.getAccount({ address: recipientAddress })).balance;
> await connection.searchTx({ sentFromOrTo: faucetAddress });
> await connection.searchTx({ sentFromOrTo: recipientAddress });
> profile.wallets.value
[ { id: 'ReYESw51lsOOr8_X', label: undefined } ]
> const wallet2 = profile.addWallet(Secp256k1HdWallet.fromMnemonic("organ wheat manage mirror wish truly tool trumpet since equip flight bracket"))
> profile.wallets.value
[ { id: 'ReYESw51lsOOr8_X', label: undefined },
{ id: 'FtIcQqMWcRpEIruk', label: undefined } ]
> profile.getIdentities(wallet.id)
[ { chainId: 'test-chain-esuZ1V',
pubkey: { algo: 'ed25519', data: [Uint8Array] } } ]
> profile.getIdentities(wallet2.id)
[]
> profile.setWalletLabel(wallet.id, "ed")
> profile.setWalletLabel(wallet2.id, "secp")
> profile.wallets.value
[ { id: 'ReYESw51lsOOr8_X', label: 'ed' },
{ id: 'FtIcQqMWcRpEIruk', label: 'secp' } ]
> const db = levelup(leveldown('./my_userprofile_db'))
> await profile.storeIn(db, "secret passwd")
> const profileFromDb = await UserProfile.loadFrom(db, "secret passwd");
> profileFromDb
UserProfile {
createdAt: 2018-07-04T16:07:14.583Z,
keyring:
Keyring { wallets: [ [Ed25519HdWallet], [Secp256k1HdWallet] ] },
...
When you are done using a WebSocket connection, disconnect the connection
> (await connection.getAccount({ address: faucetAddress })).balance
[ { quantity: '123456755876543211',
fractionalDigits: 9,
tokenTicker: 'CASH' } ]
> connection.disconnect()
undefined
> (await connection.getAccount({ address: faucetAddress })).balance
Error: Socket was closed, so no data can be sent anymore.
at ...
When using a Testnet, you can use the IovFaucet to receive tokens.
In this example we connect to a public test network.
> const mnemonic = Bip39.encode(Random.getBytes(16)).toString();
> mnemonic
'helmet album grow detail apology thank wire chef fame core private cargo'
> const profile = new UserProfile();
> const wallet = profile.addWallet(Ed25519HdWallet.fromMnemonic(mnemonic));
> const signer = new MultiChainSigner(profile);
> const { connection } = await signer.addChain(createBnsConnector("ws://rpc-private-a-x-exchangenet.iov.one:16657"));
> const chainId = connection.chainId;
> const alice = await profile.createIdentity(wallet.id, chainId, HdPaths.iov(0));
> const aliceAddress = signer.identityToAddress(alice);
> const faucet = new IovFaucet("http://faucet.x-exchangenet.iov.one:8080/");
> await faucet.credit(aliceAddress, "IOV" as TokenTicker)
> (await connection.getAccount({ address: aliceAddress })).balance
[ { quantity: '10000000000',
fractionalDigits: 9,
tokenTicker: 'IOV' } ]
This package is part of the IOV-Core repository, licensed under the Apache License 2.0 (see NOTICE and LICENSE).
FAQs
Command line interface for iov core
We found that @iov/cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.