Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
This package is part of NDNts, Named Data Networking libraries for the modern web.
This package implements the forwarding plane, the central piece of NDN stack. It exports a Forwarder type that represents the forwarding plane, and a FwFace type that represents a face attached to the forwarding plane.
You may be wondering: why there's a forwarding plane in my application? The main purpose is to demultiplex incoming packets. Suppose a producer application can serve multiple kinds of data, the forwarding plane can dispatch incoming Interests of each kind of data to the correct Interest handler function in the application, so that the application does not perform this dispatching itself.
This leads to our definition of the face: a face is a duplex stream of packets.
It could be a connection to another network node or standalone forwarder, as implemented in @ndn/l3face
package.
It could also be a part of application logic, as implemented in @ndn/endpoint
package.
Creating a FwFace
for application logic is relatively cheap: if you need to receive different kinds of packets in separate callback functions, you should create one face per callback function, instead of sharing the same face and attempting to dispatch packets yourself.
A packet transmitted or received on an FwFace
is typically an Interest or a Data.
From application logic, it is possible to associate arbitrary metadata, called a token, on an outgoing Interest, and receive them back on the corresponding Data.
You can also send a CancelInterest
command to cancel a pending Interest, and receive a RejectInterest
notice when the Interest is canceled or has expired.
Obviously, these tokens and commands are not encodable, so they are only available for communication between application logic and the forwarding plane, but cannot appear beyond the NDNts application.
It's sad but NDN does not have a formal forwarding behavior specification. This package implements a simplified version of NDN forwarding behavior specified in NDN-LAN dissertation chapter 3. The main differences from a full forwarder include:
@ndn/repo
package.These are subject to change.
FAQs
NDNts: Logical Forwarder
The npm package @ndn/fw receives a total of 12 weekly downloads. As such, @ndn/fw popularity was classified as not popular.
We found that @ndn/fw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.