
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@ritani/vendor-sdk
Advanced tools
npm -g install @ritani/vendor-sdk
To install node and npm, please refer to: pre-built installer for your platform
If you already have it, you can skip step 1 and go to step 2 directly.
Sign up on Ritani's vendor portal:
Click to Sign up and create an account
Once sign up is complete, sign in and click on the account tab. There you will find your FTP and API credentials:
Username, Password and API key
for example: ritani-inventory as project folder, ritani-inventory/data as data folder
mkdir -p ritani-inventory/data
cd ritani-inventory
newecx --set-config
Enter your project directory: .../ritani-inventory
Enter your data directory: .../ritani-inventory/data
Enter your vendor API key: ...
newecx --generate-template
template files are saved in .../ritani-inventory/template
Here is what we have in the project directory:
.
├── data
└── template
├── ...
...
├── agreed-header.js
├── fields-map.js
├── instruction.csv
└── inventory.csv
Click below to view sample data:
newecx -h
Usage: newecx [options]
Options:
-v, --version output the current version
-set --set-config to set project and data directories, ftp and api credentials
-sd --set-data-dir <data_directory> to set data directory
-sp --set-project-dir <project_directory> to set project directory
-gt --generate-template to generate template, instruction and sample data
-di --download-inventory to download latest inventory feed data from server
-dh --download-header to download agreed header from server
-df --download-fields-maps to download fields-maps from server
-da --download-all to download inventory, header and fields-maps from server
-uh --upload-header to upload agreed header to server
-uf --upload-fields-maps to upload fields-maps to server
-fuh --force-upload-header to force upload agreed header to server
-fuf --force-upload-fields-maps to force upload fields-maps to server
-mh --make-header to make agreed-header.js from inventory data
-mf --make-fields-maps to make fields-maps.js from inventory data
-vi --validate-inventory to validate inventory csv
-ra --retrieve-assets to retrieve assets of passed diamonds
-si --submit-inventory to submit original inventory feed to server
-ssi --submit-std-inventory to submit the generated standardized inventory csv to server
-sa --submit-assets to submit retrieved assets to server
-sb --submit-both-inventory-assets to submit both inventory and assets to server
-h, --help display help for command
Click here for the full documentation of the newecx cli command
To upload your inventory feed (data/inventory.csv file):
'use strict';
const node_path = require('path');
const { api_upload_inventory } = require('@ritani/vendor-sdk').core;
(async () => {
let inventory_filepath = node_path.join(__dirname(), 'data', 'inventory.csv');
console.log('api upload inventory.csv');
const result = await api_upload_inventory(inventory_filepath);
console.log(result);
})();
FAQs
Ritani Diamond Vendor Inventory SDK
The npm package @ritani/vendor-sdk receives a total of 2 weekly downloads. As such, @ritani/vendor-sdk popularity was classified as not popular.
We found that @ritani/vendor-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.