
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@my-escrow/contracts
Advanced tools
contractsTODO: description TODO EIP 1167 (minimal proxy)
Run MythX security
env $(cat .env) truffle run verify
Migrate
env $(cat .env) npm run migrate:ropsten
env $(cat .env) npm run migrate:kovan
Concat contracts
npx truffle-flattener contracts/Contract.sol
Kovan
> Compiled successfully using:
- solc: 0.5.12+commit.7709ece9.Linux.g++
Starting migrations...
======================
> Network name: 'kovan'
> Network id: 42
> Block gas limit: 0x989680
1_initial_migration.js
======================
Deploying 'Migrations'
----------------------
> transaction hash: 0x39449f5512bfdb13cb9e291f65915c7348c5a51bd55ca36a5853cd9f86fbdb01
> Blocks: 2 Seconds: 9
> contract address: 0x3dDcf6a95dBd5b539F3677dBcC2DA56924a5af74
> block number: 16315282
> block timestamp: 1579823208
> account: 0xF5B0149971eAb068D2d365ac9626d94A2AedceC4
> balance: 1.99549526
> gas used: 225237
> gas price: 20 gwei
> value sent: 0 ETH
> total cost: 0.00450474 ETH
Pausing for 2 confirmations...
------------------------------
> confirmation number: 1 (block: 16315283)
> confirmation number: 3 (block: 16315285)
> Saving migration to chain.
> Saving artifacts
-------------------------------------
> Total cost: 0.00450474 ETH
2_deploy_contracts.js
=====================
Deploying 'TwoPartyEscrowHub'
-----------------------------
> transaction hash: 0x3191124dc107f3148a9d763d76873a3e6a31868fafb3a7636f5d40106e798256
> Blocks: 1 Seconds: 5
> contract address: 0x66C16feCC3fDfF0eD879bcc69A70696064e57976
> block number: 16315290
> block timestamp: 1579823240
> account: 0xF5B0149971eAb068D2d365ac9626d94A2AedceC4
> balance: 1.91244884
> gas used: 4109958
> gas price: 20 gwei
> value sent: 0 ETH
> total cost: 0.08219916 ETH
Pausing for 2 confirmations...
------------------------------
> confirmation number: 1 (block: 16315292)
> confirmation number: 2 (block: 16315293)
Deploying 'ThreePartyEscrowHub'
-------------------------------
> transaction hash: 0xa25f4f1fa7b94e43b90c31bdb3ade4b26ea60324d4fde09210a5eca4aa0837d9
> Blocks: 2 Seconds: 9
> contract address: 0x8E8d8B9F87c2F147d9360C84f764Efb36c743f7A
> block number: 16315298
> block timestamp: 1579823272
> account: 0xF5B0149971eAb068D2d365ac9626d94A2AedceC4
> balance: 1.80822672
> gas used: 5211106
> gas price: 20 gwei
> value sent: 0 ETH
> total cost: 0.10422212 ETH
Pausing for 2 confirmations...
------------------------------
> confirmation number: 2 (block: 16315300)
> Saving migration to chain.
> Saving artifacts
-------------------------------------
> Total cost: 0.18642128 ETH
3_deploy_test_contracts.js
==========================
Deploying 'TestToken'
---------------------
> transaction hash: 0x7230614f5e9b03755c2e93587f751b50d199ebbcd1b30caf96d7a86cec7d880c
> Blocks: 2 Seconds: 9
> contract address: 0xF01e5c2efb6bD80956F085e724fA6a9925c8B02B
> block number: 16315306
> block timestamp: 1579823304
> account: 0xF5B0149971eAb068D2d365ac9626d94A2AedceC4
> balance: 1.78484688
> gas used: 1141629
> gas price: 20 gwei
> value sent: 0 ETH
> total cost: 0.02283258 ETH
Pausing for 2 confirmations...
------------------------------
> confirmation number: 2 (block: 16315308)
> Saving migration to chain.
> Saving artifacts
-------------------------------------
> Total cost: 0.02283258 ETH
4_fund_test_token.js
====================
> Saving migration to chain.
-------------------------------------
> Total cost: 0 ETH
Summary
=======
> Total deployments: 4
> Final cost: 0.2137586 ETH
FAQs
> TODO: description
The npm package @my-escrow/contracts receives a total of 0 weekly downloads. As such, @my-escrow/contracts popularity was classified as not popular.
We found that @my-escrow/contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.