
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@metamask/snaps-cli
Advanced tools
A CLI for developing MetaMask Snaps.
Use Node.js 12.11.0
or later.
We recommend nvm for managing Node.js versions.
yarn global add @metamask/snaps-cli
mkdir mySnap
cd mySnap
mm-snap init
MetaMask Snaps enables trustlessly extending the functionality of MetaMask at runtime. A Snap consist of two things: a JSON manifest and a JavaScript bundle. At present, Snaps can be published as npm packages on the public npm registry, or hosted locally during development. In the future, it will be possible to publish snaps on many different platforms, including arbitrary npm registries and IPFS.
We recommend building your Snap using this tool. You can bundle your Snap using your own tools, but it must run in SES and only use the global APIs that MetaMask exposes at runtime. Although Snaps currently execute in the browser, some browser APIs are not available to Snaps, and Snaps do not have DOM access.
Your manifest must be named snap.manifest.json
and located in the root directory of your npm package.
Here's an example manifest:
{
"version": "0.7.0",
"proposedName": "@metamask/template-snap",
"description": "A MetaMask Snap template.",
"repository": {
"type": "git",
"url": "https://github.com/MetaMask/template-snap.git"
},
"source": {
"shasum": "w3FltkDjKQZiPwM+AThnmypt0OFF7hj4ycg/kxxv+nU=",
"location": {
"npm": {
"filePath": "dist/bundle.js",
"iconPath": "images/icon.svg",
"packageName": "@metamask/template-snap",
"registry": "https://registry.npmjs.org/"
}
}
},
"initialPermissions": {
"snap_confirm": {}
},
"manifestVersion": "0.1"
}
Refer to the Snaps publishing specification and the manifest JSON schema for details.
ATTN: If your Snap is not compatible with the publishing specification, your Snap may not work properly or install at all.
This tool has default arguments assuming the following project structure:
snap-project/
├─ package.json
├─ src/
│ ├─ index.js
├─ snap.manifest.json
├─ dist/
│ ├─ bundle.js
├─ ... (all other project files and folders)
Source files other than index.js
are located through its imports.
The defaults can be overwritten using the snap.config.json
config file,
see below.
Run mm-snap --help
for usage instructions.
snap.config.json
can be placed in the project root directory. It should have string keys matching command arguments.
Values become argument defaults, which can still be overriden on the command line.
Example:
{
"src": "lib",
"dist": "out",
"port": 9000
}
The configuration file should not be published.
watch --src ... --dist ...
rebuilds on all changes in the parent directory
of src
and its children except:
node_modules/
test/
, tests/
, **/*.test.js
, and **/*.test.ts
dist
directoryserve --root ... --port ...
serves the root
directory on localhost:port
root
serves the current working directory: .
src
must be a file path when specifieddist
and root
must be directory paths when specifiedFAQs
A CLI for developing MetaMask Snaps
The npm package @metamask/snaps-cli receives a total of 959 weekly downloads. As such, @metamask/snaps-cli popularity was classified as not popular.
We found that @metamask/snaps-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.