Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
By Olivia Brown - Sep 22, 2025
@iov/ethereum
Advanced tools
@iov/ethereum
Getting started
The primary way to use @iov/ethereum is together with @iov/core. Alternatively, you can use @iov/ethereum to create offline transactions which can be posted manually.
All examples are made for use in @iov/cli and you may need to include some missing symbols if used in a different environment.
Using with @iov/core
You can use @iov/ethereum as an extension of @iov/core to interact with the Ethereum blockchain as follows.
Local test
To run Ethereum tests locally, you need to install ganache and start with the following settings:
- RPC Server:
http://127.0.0.1:8545 - Network ID:
5777 - Mnemonic:
oxygen fall sure lava energy veteran enroll frown question detail include maximum
License
This package is part of the IOV-Core repository, licensed under the Apache License 2.0 (see NOTICE and LICENSE).
FAQs
Transaction codec and client to communicate with the Ethereum blockchain
The npm package @iov/ethereum receives a total of 89 weekly downloads. As such, @iov/ethereum popularity was classified as not popular.
We found that @iov/ethereum demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Package last updated on 14 May 2019
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Research
/Security News
Identifying and Preventing Fraudulent Engineering Candidates: An Investigation into 80 Confirmed Cases
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
By Lauren Valencia, Kirill Boychenko - Sep 17, 2025
Application Security
/Research
/Security News
Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm Packages
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.
By Kush Pandya, Peter van der Zee, Olivia Brown, Socket Research Team - Sep 16, 2025