Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@jadbox/iframe-provider
Advanced tools
[![Build Status](https://travis-ci.org/ethvault/iframe-provider.svg?branch=master)](https://travis-ci.org/ethvault/iframe-provider) [![MinZipped size](https://badgen.net/bundlephobia/minzip/@ethvault/iframe-provider)](https://bundlephobia.com/result?p=@et
This is an EIP-1193 compliant Ethereum provider that communicates with a parent iframe using the Ethereum JSON RPC.
Use the iframe provider to enable a dApp to communicate with an Ethereum provider in a different context.
This was built to serve the dApps that integrate with Ethvault.
While the protocol is designed for the Ethvault dApp browser, it is meant to be general and work for any iframe based dApp browser.
Contributions are welcome.
If you want an easy drop-in solution, consider the polyfill package
which sets window.web3
and window.ethereum
to an iframe provider when the dApp is embedded in an iframe.
Use this package if you want to give the user the option to connect to the iframe provider or another provider.
You can use this provider exactly how you use the MetaMask and other injected Ethereum/web3 providers. It supports
both the legacy sendAsync
method as well as the newer send
method. It also has an enable
method for compatibility with MetaMask which sends a JSON RPC with method enable
and expects the parent to return a list of accounts in the result.
import { IFrameEthereumProvider } from '@ethvault/iframe-provider';
let ethereum;
function isIframe(): boolean {
/// Do some logic...
return true;
}
if (isIframe()) {
ethereum = new IFrameEthereumProvider();
} else {
// Use some other provider, e.g. window.ethereum from MetaMask or Infura
// ...
}
// Anything from https://github.com/ethereum/wiki/wiki/JSON-RPC should be supported
function getNetwork(): Promise<string> {
return ethereum.send('net_version');
}
You can also use this with the ethers.js library via the Web3Provider.
import { IFrameEthereumProvider } from '@ethvault/iframe-provider';
import { Web3Provider } from 'ethers';
let web3Provider = new Web3Provider(new IFrameEthereumProvider());
There are some options for the construction of the ethereum provider:
import { IFrameEthereumProvider } from '@ethvault/iframe-provider';
new IFrameEthereumProvider({
// How long to wait for the response, default 1 minute
timeoutMilliseconds: 60000,
// The origins with which this provider is allowed to communicate, default '*'
// See postMessage docs https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage
targetOrigin: 'https://myethvault.com',
});
This project was bootstrapped with TSDX.
Below is a list of commands you will probably find useful.
npm start
or yarn start
Runs the project in development/watch mode. Your project will be rebuilt upon changes. TSDX has a special logger for you convenience. Error messages are pretty printed and formatted for compatibility VS Code's Problems tab.
Your library will be rebuilt if you make edits.
npm run build
or yarn build
Bundles the package to the dist
folder.
The package is optimized and bundled with Rollup into multiple formats (CommonJS, UMD, and ES Module).
npm test
or yarn test
Runs the test watcher (Jest) in an interactive mode. By default, runs tests related to files changed since the last commit.
FAQs
[![Build Status](https://travis-ci.org/ethvault/iframe-provider.svg?branch=master)](https://travis-ci.org/ethvault/iframe-provider) [![MinZipped size](https://badgen.net/bundlephobia/minzip/@ethvault/iframe-provider)](https://bundlephobia.com/result?p=@et
The npm package @jadbox/iframe-provider receives a total of 0 weekly downloads. As such, @jadbox/iframe-provider popularity was classified as not popular.
We found that @jadbox/iframe-provider demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.