
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
@penumbra-zone/keys
Advanced tools
@penumbra-zone/keys
This package contains cryptographic keys relevant to the Penumbra blockchain.
The default export is a JSON mapping of Penumbra Action
names to their
relevant key, necessary for building cryptographic proofs for those actions.
Individual keys are also exported at @penumbra-zone/keys/[key_name]_pk.bin
.
You could configure your bundler to understand the exported key 'modules' as
assets, or, if your bundler supports import.meta.resolve
you can resolve the
path and fetch it.
const fetchConvertPk = await fetch(import.meta.resolve('@penumbra-zone/keys/convert_pk.bin'));
const convertPk = new Uint8Array(await fetchConvertPk.arrayBuffer());
For a more generic technique, the root export maps action type names to the relevant key filename. Note that not every action has an associated proving key.
import { Action } from '@penumbra-zone/protobuf/penumbra/core/transaction/v1/transaction_pb';
import actionKeys from '@penumbra-zone/keys';
async function getActionProvingKey({ action }: Action) {
const actionName = action.case;
const keyName = actionKeys[actionName];
if (keyName) {
const fetchKey = await fetch(import.meta.resolve(keyName, '@penumbra-zone/keys'));
const pk = new Uint8Array(await fetchKey.arrayBuffer());
return pk;
}
}
FAQs
Tool to download proving keys for Penumbra
We found that @penumbra-zone/keys demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.