
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@proyecto-didi/didi-blockchain-manager
Advanced tools
Project to abstract the use of multiblockains in DIDI project
This library is intented to support multiblockchain configuration for the functionalities provided by uPort libraries (here). Based on the received DID and its prefix, it will select the blockchain to connect and support the uPort functions. Below there is a description of how to implement it.
BlockchainManagerConfig
The class takes three parameters:
gasPrice: It's the gas price. For testing purposes a value of 10000 can be safely used.
providerConfig: It's a JSON object containing the network configurations to use when receiving the DID. The DIDs follow certain format and it should look like this:
did:ethr:0x0d0fa2cd3813412e94597103dbf715c7afb8c038
The above DID will route to the variable specified in mainnet
did:ethr:lacchain:0x0d0fa2cd3813412e94597103dbf715c7afb8c038
The above DID will route to the variable specified in lacchain
The providerConfig JSON must be similar to this:
PROVIDER_CONFIG = {
networks: [
{
name: 'mainnet',
rpcUrl: BLOCKCHAIN_URL_MAIN,
registry: BLOCKCHAIN_CONTRACT_MAIN
},
{
name: 'lacchain',
rpcUrl: BLOCKCHAIN_URL_LAC,
registry: BLOCKCHAIN_CONTRACT_LAC
},
{
name: 'bfa',
rpcUrl: BLOCKCHAIN_URL_BFA,
registry: BLOCKCHAIN_CONTRACT_BFA
},
{
name: 'rsk',
rpcUrl: BLOCKCHAIN_URL_RSK,
registry: BLOCKCHAIN_CONTRACT_RSK
}
]
};
NOTE 1: It is important to put the prefix on the DID, equal to the one in the JSON name attribute in order to route right. (for mainnet, no prefix must be entered)
NOTE 2: All of these variables must be defined in the .env
file in the root folder.
Gas Increment value to increase the gas in the transaction for safeguard. By default is 1.1 (10%). This value can be defined in the ENV file as GAS_INCREMENT
FAQs
Project to abstract the use of multiblockains in DIDI project
We found that @proyecto-didi/didi-blockchain-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.