
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@nethermindeth/warp
Advanced tools
Warp brings Solidity to Starknet, making it possible to transpile Ethereum smart contracts to Starknet Cairo Contracts.
:warning: Note: Cairo 1 support is being developed at this branch.
Docker compose provides a ready to use environment featuring warp and devnet.
Note: Executing Warp using Docker works only for x86 architecture, ARM architectures (such as Apple's M1) will be supported soon.
docker-compose up
docker-compose exec warp warp transpile exampleContracts/ERC20.sol
It's best to copy the contract/repo to the warp directory so it is available in container via volume. Use contract's paths relative to warp root. For example, assuming you've copied your project to warp/projects/myproject you can replace exampleContracts/ERC20.sol with projects/myproject/mycontract.sol in the above command.
docker-compose exec warp warp compile warp_output/example__contracts/ERC20__WC__WARP.cairo
docker-compose exec warp starknet deploy --no_wallet --contract warp_output/example__contracts/ERC20__WC__WARP_compiled.json --gateway_url http://devnet:5050
You can read the documentation here.
To install Warp follow the installation instructions here.
To build Warp for development see the contributing guidelines.
If you have used installation method 1 you can use the warp command in any folder. If you have used installation method 2, you will have to specify the path to the warp directory followed by bin/warp e.g path_to_warp_repo/bin/warp ...
Select your network and wallet types. It's recommended to set these as environment variables but they can also be passed as explicit arguments to the Warp CLI and the Starknet CLI.
export STARKNET_WALLET=starkware.starknet.wallets.open_zeppelin.OpenZeppelinAccount
export STARKNET_NETWORK=alpha-goerli
Make sure you have a Starknet account set up, if you have not done so yet please:
warp deploy_account
warp transpile <path to Solidity contract>
To declare a Starknet contract:
warp declare <path to Starknet contract>
Please note to deploy a contract you will first have to declare it.
To deploy a Starknet contract:
warp deploy <path to Starknet contract>
The deploy command will generate the compiled json file as well as the abi json
file. Use warp deploy --help command to see more deployment options.
Please see the list below:
| Support Status | Symbol |
|---|---|
| Will likely never be supported | :x: |
| Being developed/investigated | :hammer_and_pick: |
| Currently Unknown/If added in Cairo | :question: |
| Solidity | Support Status |
|---|---|
| fallback functions with args | :hammer_and_pick: |
| delegate calls | :hammer_and_pick: |
| indexed arrays in event | :hammer_and_pick: |
| low level calls | :x: |
| nested tuple expressions | :question: |
| gasleft() | :question: |
| msg.value | :question: |
| msg.sig | :question: |
| msg.data | :question: |
| tx.gasprice | :question: |
| tx.origin | :question: |
| try/catch | :question: |
| block.coinbase | :question: |
| block.gaslimit | :question: |
| block.basefee | :question: |
| block.chainid | :question: |
| block.difficulty | :x: |
| precompiles (apart from ecrecover) | :question: |
| selfdestruct | :question: |
| blockhash | :question: |
| functions pointers in storage | :question: |
| sha256 (use keccak256 instead) | :x: |
| receive | :question: |
| Inline Yul Assembly - (memory, calldata, storage) | :question: |
| user defined errors | :question: |
| function call options e.g x.f{gas: 10000}(arg1) | :question: |
| member access of address object e.g address.balance | :question: |
| nested tuple assignments | :question: |
Note: We have changed the return of ecrecover to be uint160 because we use the address type for Starknet addresses.
Note: Executing Warp using Docker works only for x86 architecture, ARM architectures (such as Apple's M1) will be supported soon.
Build the image from source:
docker build -t warp .
Run the container with the same options and arguments as the Warp binary:
docker run --rm -v $PWD:/dapp --user $(id -u):$(id -g) warp transpile exampleContracts/ERC20.sol
You can read about contributing, first steps, development tips and testing for contributors here
FAQs
Solidity to Cairo Transpiler
The npm package @nethermindeth/warp receives a total of 12 weekly downloads. As such, @nethermindeth/warp popularity was classified as not popular.
We found that @nethermindeth/warp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.