Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@rabbitholegg/questdk-plugin-across
Advanced tools
Across uses really simple architecture. They don't use payable functions, every token and ETH all go through the same contract, and use the same function call. This is about as straight forward a plugin as exists. ## ETH/BASE TOKEN No payables, everyth
Across uses really simple architecture. They don't use payable functions, every token and ETH all go through the same contract, and use the same function call. This is about as straight forward a plugin as exists.
No payables, everything uses the same functions.
https://etherscan.io/tx/0xa90420546af9facb433464c7d6de24dee62b63ec5eff9e542ccc54a7c1be0e1c
https://arbiscan.io/tx/0xae9c37671cc94cd9e4487a23b62c93c606601f7a1d5b751d7f2d8a71dc4f65ef
All ERC20 use the same function call and exit through the same address.
https://etherscan.io/tx/0x1d27d0bd0b8bc1894f8e3b30fdb527f2a3d8eee2efaf6d43d23af05f4c7c976b
https://arbiscan.io/tx/0x0eed06fe27fcef1666d62ce9a0740eaf498ba94664588f3089b00602c930f23b
You can use the following example code to pull down test transactions in the correct format easily: https://viem.sh/docs/actions/public/getTransaction.html#example
FAQs
Across uses really simple architecture. They don't use payable functions, every token and ETH all go through the same contract, and use the same function call. This is about as straight forward a plugin as exists. ## ETH/BASE TOKEN No payables, everyth
The npm package @rabbitholegg/questdk-plugin-across receives a total of 1 weekly downloads. As such, @rabbitholegg/questdk-plugin-across popularity was classified as not popular.
We found that @rabbitholegg/questdk-plugin-across demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.