
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@mstable/delegatee-lists
Advanced tools
🕴 mStable Delegatee Lists specification
Forked from Uniswap's Token Lists specification.
This package includes a JSON schema for delegatee lists, and TypeScript utilities for working with delegatee lists.
The JSON schema represents the technical specification for a delegatee list which can be used in a dApp interface, such as the mStable Governance app.
mStable Delegatee Lists is a specification for lists of delegatee metadata (e.g. address, name, avatar, ...) that can be used by any dApp interfaces that needs one or more lists of delegatees.
Anyone can create and maintain a delegatee list, as long as they follow the specification.
Specifically an instance of a delegatee list is a JSON blob that contains a list of delegatee metadata for use in dApp user interfaces. Delegatee list JSON must validate against the JSON schema in order to be used in the mStable Governance app. Delegatees on delegatee lists, and delegatee lists themselves, are tagged so that users can easily find them.
The JSON schema ID is https://mstable.org/delegateelist.schema.json
This package does not include code for delegatee list validation. You can easily do this by including a library such as ajv to perform the validation against the JSON schema. The schema is exported from the package for ease of use.
The best way to manually author delegatee lists is to use an editor that supports JSON schema validation. Most popular code editors do, such as IntelliJ or VSCode. Other editors can be found here.
The schema is registered in the SchemaStore, and any file that matches
the pattern *.delegateelist.json
should
automatically utilize
the JSON schema for the supported text editors.
In order for your delegatee list to be able to be used, it must pass all JSON schema validation.
If you want to automate delegatee listing, e.g. by pulling from a smart contract, or other sources, you can use this npm package to take advantage of the JSON schema for validation and the TypeScript types. Otherwise, you are simply working with JSON. All the usual tools apply, e.g.:
import { DelegateeList, schema } from '@mstable/delegatee-lists'
// generate your delegatee list however you like.
const myList: DelegateeList = generateMyDelegateeList();
// use a tool like `ajv` to validate your generated delegatee list
validateMyDelegateeList(myList, schema);
// print the resulting JSON to stdout
process.stdout.write(JSON.stringify(myList));
Lists include a version
field, which follows semantic versioning.
List versions must follow the rules:
Changing a delegatee address is considered both a remove and an add, and should be a major version update.
Note that list versioning is used to improve the user experience, but not for security, i.e. list versions are not meant to provide protection against malicious updates to a delegatee list; i.e. the list semver is used as a lossy compression of the diff of list updates. List updates may still be diffed in the client dApp.
Once you have authored the list, you can make it available at any URI. Prefer pinning your list to IPFS (e.g. via pinata.cloud) and referencing the list by an ENS name that resolves to the contenthash.
If hosted on HTTPS, make sure the endpoint is configured to send an access-control-allow-origin header to avoid CORS errors.
An ENS name can be assigned to an IPFS hash via the contenthash text record. This is the preferred way of referencing your list.
You can find a simple example of a delegatee list in test/schema/example.delegateelist.json.
FAQs
🕴 mStable Delegatee Lists specification
The npm package @mstable/delegatee-lists receives a total of 0 weekly downloads. As such, @mstable/delegatee-lists popularity was classified as not popular.
We found that @mstable/delegatee-lists demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.