
Research
/Security News
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
@moshcoder/moshpit-registry
Advanced tools
Client for the Moshpit registry — resolve names, read key pins, list endings. Cached, coalesced, bounded, and clear about which failures are answers.
Client for the Moshpit registry — resolve names, read key pins, list endings.
npm i @moshcoder/moshpit-registry
import { createRegistry } from "@moshcoder/moshpit-registry";
const registry = createRegistry();
await registry.resolve("blue.eggs"); // where it points, and who holds the ending
await registry.pins("blue.eggs", "tls"); // the keys it may present
await registry.tlds(); // every ending claimed
Three clients had grown independently — the resolver bridge, the pinning proxy, and the browser extension. They agreed on the endpoints and disagreed on everything that matters under load: which failures are cacheable, whether two simultaneous lookups become one request, how long to wait before giving up.
A definite no is not an outage. A 400 or 404 is an answer — the name is
malformed, or nobody has published a key — and is cached for as long as a real
answer. A timeout or a 500 is not, and is remembered only briefly so an outage
is not amplified into a flood.
A client that treats them alike either fails closed forever or fails open once, and the second is how a namespace gets quietly defeated.
An empty pin list is "no key published", not "any key will do".
null instead of throwing, because every caller here is
deciding whether to connect, not whether to crashmoshpit-registry resolve <name> where a name points, and who holds it
moshpit-registry pins <name> [kind] the keys a name may present (tls | mtp)
moshpit-registry tlds every ending claimed
--registry URL a self-hosted pit
--json raw JSON instead of a summary
$ moshpit-registry resolve california.oranges
california.oranges
ending held yes
name minted yes
points at nothing yet
MIT.
FAQs
Client for the Moshpit registry — resolve names, read key pins, list endings. Cached, coalesced, bounded, and clear about which failures are answers.
We found that @moshcoder/moshpit-registry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.