
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
@josepot/ts-scale-codec
Advanced tools
A modular, composable, strongly typed and lightweight implementation of the [SCALE Codec](https://docs.substrate.io/v3/advanced/scale-codec/)
A modular, composable, strongly typed and lightweight implementation of the SCALE Codec
npm install --save @josepot/ts-scale-codec
import { Struct, U32, Vector, Str, Enum, Bool } from "@josepot/ts-scale-codec"
import { bufferToHex } from "./utils"
const [encoder, decoder] = Struct({
id: U32,
name: Str,
friendIds: Vector(U32),
event: Enum({
one: Str,
many: Vector(Str),
allOrNothing: Bool,
})
})
/*
Something very important is the types that are being inferred from this definition,
which both the encoder and the decoder will use. For instance, the input of the
encoder must be compatible with the following interface:
interface SomeData {
id: number;
name: string;
friendIds: number[];
event:
| { tag: "one"; value: string; }
| { tag: "many"; value: string[]; }
| { tag: "allOrNothing"; value: boolean; };
}
Which, as you might expect, it's the same interface that's returned by the
decoder.
*/
const encodedData: ArrayBuffer = encoder({
id: 100,
name: "Some name",
friendIds: [1, 2, 3],
event: { tag: "allOrNothing" as const, value: true }
})
console.log(bufferToHex(encodedData))
// => 0x6400000024536f6d65206e616d650c0100000002000000030000000201
const decodedData = decoder(encodedData).value
// also possible:
// const decodedData = decoder("0x6400000024536f6d65206e616d650c0100000002000000030000000201").value
console.log(JSON.stringify(decodedData, null, 2))
// =>
//{
// "id": 100,
// "name": "Some name",
// "friendIds": [
// 1,
// 2,
// 3
// ],
// "event": {
// "tag": "allOrNothing",
// "value": true
// }
//}
In this library you won't find common definitions like AccountId
. However,
since the definitions of this library are enhanceable and composable, it's
very easy to create new custom definitions. For instance, the implementation of
the Str
Codec looks like this:
import { enhanceCodec, Vector, U8 } from "@/."
const fromStringToBytes = (value: string) =>
value.split("").map((_, idx) => value.charCodeAt(idx))
const fromBytesToString = (bytes: number[]) => String.fromCharCode(...bytes)
export const Str = enhanceCodec(
Vector(U8),
fromStringToBytes,
fromBytesToString,
)
Similarly, you could implement any other definitions are that based on other
definitions. For instance, a possible implementation of an AccountId
definition could be:
import { enhanceCodec, Bytes } from "@josepot/ts-scale-codec"
import { decodeAddress, encodeAddress } from "@polkadot/util-crypto"
export const AccountId = enhanceCodec(
Bytes(32),
decodeAddress,
encodeAddress,
)
FAQs
A modular, composable, strongly typed and lightweight implementation of the [SCALE Codec](https://docs.substrate.io/v3/advanced/scale-codec/)
We found that @josepot/ts-scale-codec demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.