
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@mintbase-js/auth
Advanced tools
[//]: # { "title": "@mintbase-js/auth", "order": "4" }
This package abstracts login, auth and signing functionality away from @mintbase-js/sdk
core.
As more complex use cases grow with more complex credential verification (ZK), message signing and whatever the future of web3 may hold, having standalone methods and documentation around these features is prudent.
A stateful module that wraps the core features found in near/wallet-selector.
This module can be used as a framework agnostic wrapper using framework specific integrations:
Check back soon for documentation on wallet selector wrapper methods and example usage with other frameworks in the near future.
read about config global variables on: Config SDK method
The primary method used for loading a NEAR account into your Node programs is via the connect
method
connect(
accountId: string,
keyStore: Keystore,
network: NearNetwork = 'testnet'
): Promise<Account>
This method uses near-api-js
to load account accountId
with credentials in the provided keystore.
{% hint style="info" %}
To use the near account signing method with the SDK contract api, you will need to implement a form of key management.
You will want to read up on using KeyStore
in the NEAR Documentation
{% endhint %}
Example usage: {% code title="loadAccount.ts" overflow="wrap" lineNumbers="true" %}
import { connect } from '@mintbase-js/auth';
import { KeyPair, InMemoryKeyStore, KeyStore } from '@mintbase-js/sdk';
const loadAuthenticatedNearAccountInNodeJS = async (accountId: string) => {
// NOTE: You will have to implement the method that securely fetches your private key.
// See above note
const privateKey: string = await <your-super-secure-key-method>();
const keyStore: KeyStore = new InMemoryKeyStore();
keyStore.setKey(
NEAR_NETWORK,
account,
KeyPair.fromString(privateKey),
);
return await connect(accountId, keyStore);
}
{% endcode %}
Here is a working example from our testing library of this using GCP Secret Manager.
FAQs
Wallet and auth functions for Mintbase JS SDK
The npm package @mintbase-js/auth receives a total of 222 weekly downloads. As such, @mintbase-js/auth popularity was classified as not popular.
We found that @mintbase-js/auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.