
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@khgame/dg-provider
Advanced tools
The provider is ultimately responsible for all function calls within the business logic. It generally includes (but is not limited to) two types of processing procedure.
In order to make a specific provider that actually supports a business scenario, A class who is inherit the 'Provider' class and implement Provide's interfaces should be provided.
Those implementations is aimed at provide the concrete usages to a remote service.
there are two kinds of Processing procedure:
Interface files in the directory ./src/remoteService can be used as references.
By the way, if the remote service is implemented using js/ts, you can also import these interfaces directly into the project.
token
check balance of the userIdentity
response should be the value string of user's balance
{ "result": QUANTITY_NUMBER }
hset
get all scopes in the service
response should be a list of all scopes
{ "result": [ ... ] }
get all keys of a scope in the service
response should be a list of all keys in the scope
{ "result": [ ... ] }
check is the key are provided in the scope
response should indicates whether the key is exist
{ "result": true/false }
get a value by given scope and key
response should be the value of given scope and key
{ "result": VAL }
get a key-value pairs by given scope
response should be a map of all key-value pairs in the scope
{ "result": { KEY: VAL, ... } }
action
get the count of all performed actions
generally, it is exactly equal to the nonce(starts at 1) or nonce(starts at 0) + 1
response should be the value of nonce
{ "result": NONCE_VALUE }
get actions by given start position and limit
response should be the actions of the nonce from the start to start + limit
{ "result": [ { nonce: NONCE_VALUE, action: ACTION_RECORD}] }
the structure of the action is given in the next chapter
receipt
get receipt by receiptId
{ "result": {id, status, creator, sym, quantity, receiver, tariff, create_at, update_at} }
get a list of receipts
option :{status?, creator?, sym?, receiver?}
sort :{quantity?, create_at?, update_at?}
[optional] validateSign : (login)
User side
user withdraw token from layer 2 to layer 1
user charge tokens from layer 1 to layer 2
user transfer tokens to another
pay tokens and create an receipt
Game server side
set value by scope and key
inc number value by scope and key
del value by scope and key
commit the receipt and send tokens to receiver and official accounts (by logic server)
abort the receipt and return tokens (by logic server)
FAQs
## models
We found that @khgame/dg-provider demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.