
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@nftchance/plug-core
Advanced tools
> [!NOTE] > This repository is a submodule of the larger [Plug monorepo](https://github.com/nftchance/plug) that contains all the required pieces to run the entire Plug stack yourself.
[!NOTE] This repository is a submodule of the larger Plug monorepo that contains all the required pieces to run the entire Plug stack yourself.
The core package of Plug powers the building and verification of declarative messages in both a server-context and interactive-wallet environment using the connected wallet when possible.
In order to run @nftchance/plug-core
it is necessary to install all of the following dependencies first:
├─ foundry - "Foundry is a blazing fast, portable and modular toolkit for Ethereum application."
└─ pnpm — "Efficient package manager for Node modules."
To run the tests of @nftchance/plug-core
is incredibly straightforward. Open your terminal and run:
pnpm i
forge test
In Plug we utilize a self-referencing architecture that enables the ability to mine addresses and then refer to the constants within that contract. This is done so that any time the Factory
is updated, we do not need to worry about manually updating the address everywhere that it is used. To generate the proper files run:
pnpm build:mine:quick
NOTE Due to the architecture, you will need to mine the addresses twice in order for everything to function as the bytecode of things will change once the addresses are updated in
PlugAddressesLib
. A signal to know that you need to run it again is if a test results inunexpected-address
.This is only required when you've made changes to a base contract. If you have not made any changes to the base contracts, you can skip this step. If something is reverting with
unexpected-address
orinvalid-initcode
there is something wrong with the compiler that you are using. Issues can be varying in severity and I will not have time to troubleshoot them all.
For version management assistance, @nftchance/plug-core
is built with the help of @changesets/cli
. When it is time for a release simply open your terminal and run:
pnpm changeset add
With a changeset created all you have to do is submit your commit/PR to the repository. Everything else will be handled for you.
FAQs
> [!NOTE] > This repository is a submodule of the larger [Plug monorepo](https://github.com/nftchance/plug) that contains all the required pieces to run the entire Plug stack yourself.
We found that @nftchance/plug-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.