
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@linkdesu/hw-app-ckb
Advanced tools
Ledger Hardware Wallet CKB JavaScript bindings.
Please see the changelog and release docs for this package.
Here is a sample app for Node:
let Transport = require("@ledgerhq/hw-transport-node-hid").default;
let Ckb = require("@obsidiansystems/hw-app-ckb").default;
const getWalletId = async () => {
const transport = await Transport.create();
const ckb = new Ckb(transport);
const result = await ckb.getWalletId();
return result;
};
const signTransaction = async () => {
const transport = await Transport.create();
const ckb = new Ckb(transport);
contexts = [ "010000000d0200001c000000200000006e00000092000000ee000000f10100000000000002000000a563884b3686078ec7e7677a5f86449b15cf2693f3c1241766c6996f206cc5410200000000ace5ea83c478bb866edf122ff862085789158f5cbff155b7bb5f13058555b708000000000101000000327f1fc62c53530c6c27018f1e8cee27c35c0370c3b4d3376daf8fe110e7d8cb020000000000000000000000c399495011b912999dbc72cf54982924e328ae170654ef76c8aba190ca376307000000000000000000000000c317d0b0b2a513ab1206e6d454c1960de7d7b4b80d0748a3e1f9cb197b74b8a501000000030100000c000000a20000009600000010000000180000006100000000e8764817000000490000001000000030000000310000009bd7e06f3ecf4be0f2fcd2188b23f1b9fcc88e5d4b65a8637b17723bbda3cce80114000000e5260d839a786ac2a909181df9a423f1efbe863d3500000010000000300000003100000082d76d1b75fe2fd9a27dfbaa65a039221a380d76c926f378d3f81cf3e7e13f2e01000000006100000010000000180000006100000064e5b27317000000490000001000000030000000310000009bd7e06f3ecf4be0f2fcd2188b23f1b9fcc88e5d4b65a8637b17723bbda3cce80114000000e5260d839a786ac2a909181df9a423f1efbe863d1c0000000c0000001800000008000000520700000000000000000000"
, "00000000570100001c000000200000006e000000b2000000e20000004b0100000000000002000000a563884b3686078ec7e7677a5f86449b15cf2693f3c1241766c6996f206cc5410200000000ace5ea83c478bb866edf122ff862085789158f5cbff155b7bb5f13058555b708000000000102000000327f1fc62c53530c6c27018f1e8cee27c35c0370c3b4d3376daf8fe110e7d8cb4930ba433e606a53f4f283f02dddeb6d51b0dc3e463629b14a27995de9c71eca01000000ba08000000010020b1b547956a0dfb7ea618231563b3acd23607586e939f88e5a6db5f392b2e78d500000000690000000800000061000000100000001800000061000000c561436317000000490000001000000030000000310000009bd7e06f3ecf4be0f2fcd2188b23f1b9fcc88e5d4b65a8637b17723bbda3cce80114000000e5260d839a786ac2a909181df9a423f1efbe863d0c0000000800000000000000" ];
transaction = "d00100000c000000bc010000b00100001c000000200000006e00000072000000ce0000009c0100000000000002000000a563884b3686078ec7e7677a5f86449b15cf2693f3c1241766c6996f206cc5410200000000ace5ea83c478bb866edf122ff862085789158f5cbff155b7bb5f13058555b708000000000100000000020000000000000000000000b1b547956a0dfb7ea618231563b3acd23607586e939f88e5a6db5f392b2e78d5010000000000000000000000258e82bab2af21fd8899fc872742f4acea831f5e4c232297816b9bf4a19597a900000000ce0000000c0000006d0000006100000010000000180000006100000000e8764817000000490000001000000030000000310000009bd7e06f3ecf4be0f2fcd2188b23f1b9fcc88e5d4b65a8637b17723bbda3cce80114000000e5260d839a786ac2a909181df9a423f1efbe863d61000000100000001800000061000000e91c708e17000000490000001000000030000000310000009bd7e06f3ecf4be0f2fcd2188b23f1b9fcc88e5d4b65a8637b17723bbda3cce80114000000e5260d839a786ac2a909181df9a423f1efbe863d140000000c000000100000000000000000000000140000000c000000100000000000000000000000"
const result = await ckb.signTransaction("44'/309'/0'/1/0", transaction, null, contexts, "44'/309'/0'/1/0");
return result;
};
const getVersion = async () => {
const transport = await Transport.create();
const ckb = new Ckb(transport);
const versionInfo = await ckb.getAppConfiguration();
return versionInfo;
};
const getAddress = async () => {
const transport = await Transport.create();
const ckb = new Ckb(transport);
const result = await ckb.getWalletPublicKey("44'/309'/0'/1/0");
return result;
};
const doAll = async () => {
walletId = await getWalletId();
console.log(walletId);
version = await getVersion();
console.log(version);
address = await getAddress();;
console.log(address);
signature = await signTransaction();
console.log(signature);
};
doAll().catch(err => console.log(err));
Nervos API
transport
Transport<any>scrambleKey
string (optional, default "CKB"
)import Ckb from "@obsidiansystems/hw-app-ckb";
const ckb = new Ckb(transport);
get CKB address for a given BIP 32 path.
const result = await ckb.getWalletPublicKey("44'/144'/0'/0/0");
const publicKey = result.publicKey;
const lockArg = result.lockArg;
const address = result.address;
Returns Promise<string> an object with a publicKey, lockArg, and (secp256k1+blake160) address.
get extended public key for a given BIP 32 path.
path
string a path in BIP 32 formatconst result = await ckb.getWalletPublicKey("44'/144'/0'/0/0");
const publicKey = result;
Returns Promise<string> an object with a publicKey
Sign a Nervos transaction with a given BIP 32 path
signPath
(string | BIPPath | [number]) the path to sign with, in BIP 32 formatrawTx
(string | blockchain.RawTransactionJSON)groupWitnessesHex
[string]? hex of in-group and extra witnesses to include in signaturerawContextsTx
[(string | blockchain.RawTransactionJSON)]changePath
(string | BIPPath | [number]) the path the transaction sends change to, in BIP 32 format (optional, defaults to signPath)rawTxHex
transaction to signcontextTransaction
list of transaction contexts for parsingTODO
Returns Promise<string> a signature as hex string
Construct an AnnotatedTransaction for a given collection of signing data
Parameters are the same as for signTransaction, but no ledger interaction is attempted.
AnnotatedTransaction is a type defined for the ledger app that collects all of the information needed to securely confirm a transaction on-screen and a few bits of duplicative information to allow it to be processed as a stream.
signPath
(string | BIPPath | [number])rawTx
(string | RawTransactionJSON)groupWitnesses
[string]?rawContextsTx
[(string | RawTransactionJSON)]changePath
(string | BIPPath | [number])Returns AnnotatedTransactionJSON
Sign an already constructed AnnotatedTransaction.
tx
(AnnotatedTransaction | AnnotatedTransactionJSON)An empty WitnessArgs with enough space to fit a sighash signature into.
Get the version of the Nervos app installed on the hardware device
const result = await ckb.getAppConfiguration();
{
"version": "1.0.3",
"hash": "0000000000000000000000000000000000000000"
}
Returns Promise<{version: string, hash: string}> an object with a version
Get the wallet identifier for the Ledger wallet
const id = await ckb.getWalletId();
"0x69c46b6dd072a2693378ef4f5f35dcd82f826dc1fdcc891255db5870f54b06e6"
FAQs
Ledger Hardware Wallet Nervos CKB API
We found that @linkdesu/hw-app-ckb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.