
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@myetherwallet/mewconnect-web-client
Advanced tools
The example requires both MEWconnect-Client (this repo) and MEWconnect-Signal-Server (mew-signer-hs)
Clone the repo:
git clone <repo address>
Install the dependencies:
npm install
Start the server serving the example initiator and receiver:
npm start
Clone the repo:
git clone <repo address>
Install the dependencies:
npm install
Start the signaling server:
npm start
In the browser via the file /browser/MewConnect.min.js
Two Peers are needed with one designated as the Initiator and the other as the Receiver.
let mewConnectClient = new MewConnect.Client(communicatorFunc, loggingFunc, depends);
(MewConnect.Client takes the same parameters)
The MewConnect takes:
communicatorFunc (Optional):
let signalStateChange = function(signal, data){
if(signal === "codeDisplay"){
console.log(data); // this is the code that gets entered into the receiver
};
};
registerLifeCycleListener
loggingFunc (Optional):
additionalLibs (Optional):
let cryptoFuncs = new MewConnect.Crypto(crypto, secp256k1, ethereumjs-util, buffer.Buffer);
let depends = {wrtc: MewRTC,
cryptoImpl: cryptoFuncs,
io: io,
ethUtils: ""
};
The url of the signaling server is passed to the initiatorStart method on MewConnectInitiator which begins the sequence by connecting to the signaling server and waiting for the signal indicating a receiver peer is ready.
let url = "https://localhost:3001"; //Url to the signaling server
mewConnectInitiator.initiatorStart(url);
let mewConnectInitiator = new MewConnect.Initiator(communicatorFunc, loggingFunc, depends);
let mewConnectReceiver = new MewConnect.Receiver(communicatorFunc, loggingFunc, depends);
The url of the signaling server and an object containing the key and connection Id from the initiator is passed to the receiverStart method on MewConnect. This begins the sequence of connecting to the signaling server and then creating the WebRTC connection between the Initiator and Receiver.
let parameters = {
key: "part of the connection code before the dash",
connId: "part of the connection code after the dash"
};
or using the helper on MewConnect
let parameters = mewConnectReceiver.parseConnectionDetailString(connectionCode);
let url = "https://localhost:3001"; //Url to the signaling server
mewConnectReceiver.receiverStart(url, parameters);
The dist folder version contains only the Web Client for use in a bundle via a require call.
The contents of the browser directory expose all the components for setting up the Web Core, and a Client on window.
It can be added via a script tag:
<script src="./browser/MewConnect.min.js"></script>
FAQs
[MEWconnect Demo](https://myetherwallet.github.io/MEWconnect-web-client/#/home)
We found that @myetherwallet/mewconnect-web-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.