
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@minka/bridge-sdk
Advanced tools
Bridge SDK provides two main components:
Server implements two-phase protocol for the ledger. Incoming requests are persisted in the bridge database as entries, intents and commands. When processing is requred, job is created which will be assigned to an available processor for processing.
Server provides proxy to the ledger in order for 3rd party system to be able to communicate with the ledger. Proxy will establish secure communication when calling the ledger and sign payload with the bridge key when needed.
Effects can also be registered in the server. Effects are used to extend the ledger core functionalities by observing and reacting on events raised when a change occurs with ledger data.
Exposed two-phase commit endpoints:
Method | Path | Description |
---|---|---|
POST | /v2/credits | prepares credit transaction |
POST | /v2/credits/<handle>/abort | aborts credit transaction |
POST | /v2/credits/<handle>/commit | commits credit transaction |
POST | /v2/debits | prepares debit transaction |
POST | /v2/debits/<handle>/abort | aborts debit transaction |
POST | /v2/debits/<handle>/commit | commits debit transaction |
PUT | /v2/intents/<handle> | updates intent record |
Exposed job endpoints:
Method | Path | Description |
---|---|---|
POST | /v2/jobs/<handle>/continue | schedules suspended job for processing |
Exposed proxy endpoints:
Method | Path | Description |
---|---|---|
POST | /v2/proxy/intents | create an intent |
GET | /v2/proxy/intents | fetch intents |
GET | /v2/proxy/intents/<handle> | fetch an intent |
POST | /v2/proxy/signers | create a signer |
PUT | /v2/proxy/signers/<handle> | update a signer |
GET | /v2/proxy/signers | fetch signers |
GET | /v2/proxy/signers/<handle> | fetch a signer |
POST | /v2/proxy/wallets | create a wallet |
PUT | /v2/proxy/wallets/<handle> | update a wallet |
GET | /v2/proxy/wallets | fetch wallets |
GET | /v2/proxy/wallets/<handle> | fetch a wallet |
GET | /v2/proxy/wallets/<handle>/balances | fetch wallet balances |
Exposed effects endpoints:
Method | Path | Description |
---|---|---|
POST | /v2/effects/<handle> | executes a registered effect |
Processor listens for pending jobs in the system and executes them. Each processor must have unique handle in the system which is used for job balancing across processors. Processing of a job can be suspended for predefined time (e.g. 5 minutes, waiting for banking core) or indefinitely which requires manual job continuation.
Run nx test bridge-sdk
to execute the unit tests via Jest.
Run nx lint bridge-sdk
to execute the lint via ESLint.
FAQs
## Components
The npm package @minka/bridge-sdk receives a total of 65 weekly downloads. As such, @minka/bridge-sdk popularity was classified as not popular.
We found that @minka/bridge-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.