Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@silencelaboratories/universal-mpc-auth
Advanced tools
Install the SDK:
npm i --save @silencelaboratories/mpc-sdk
The library provides the following 2 main components:
The MpcAuthenticator
class is designed to handle authentication processes using MPC SDK for {2,2} TSS.
import {
MpcAuthenticator,
StoragePlatform,
WalletId,
} from "@silencelaboratories/mpc-sdk";
// 1. Set up MpcAuthenticator with custom storage and development mode
const storage = new CliStorage(); // Ref: https://github.com/silence-laboratories/mpc-auth-client/blob/staging/packages/biconomy/cli/mpc/storage.ts
const mpcAuth = MpcAuthenticator.instance({
walletId: WalletId.Biconomy,
storagePlatform: StoragePlatform.CLI,
customStorage: storage,
isDev: process.env.NEXT_PUBLIC_SDK_MODE === "development",
});
// 2. Generate QR code for Silent Shard App pairing
const qrCode = await mpcAuth.initPairing();
// ... Scanning happens
const pairingSessionData = await mpcAuth.runStartPairingSession();
await mpcAuth.runEndPairingSession(pairingSessionData);
// 3. Key generation after pairing is done
const keygenResult = await mpcAuth.runKeygen(); // The generated keyshares will be stored to do signing later
// 4. (Optional) Sent backup to Silent Shard App for key restoration later
await mpcAuth.runBackup("demopassword");
walletId
- Supported Wallet ID to use for identifying the wallet. Check WalletId
enum for available options.storagePlatform
- Supported Storage platform to use for storing keyshares and pairing data. Check StoragePlatform
enum for available options.customStorage
- Custom storage object to use for storing keyshares and pairing data. If not provided, the library will use the default storage, which is localStorage
(assuming the library is used in the browser).isDev
- Development mode flag. If set to true
, the library will use the development mode for the MPC SDK.The library provides a way to use custom storage for data storing. The custom storage must implement IStorage
interface, MpcAuthenticator
will access the storage using the provided methods.
interface IStorage {
clearStorageData: () => Promise<void>;
setStorageData: (data: StorageData) => Promise<void>;
getStorageData: () => Promise<StorageData>;
migrate?(): void;
}
The MpcSigner
class is designed for signing Ethereum transactions and messages using MpcAuthenticator
keyshares.
An example of MpcSigner
with Biconomy
account creation:
// MpcSigner initialization
const provider = new providers.JsonRpcProvider("https://rpc.sepolia.org");
const mpcSigner = await MpcSigner.instance(mpcAuth, provider); // Now, mpcSigner could be used to sign ETH transactions
const biconomySmartAccount = await createSmartAccountClient({
signer: client as SupportedSigner,
bundlerUrl: `https://bundler.biconomy.io/api/v2/11155111/${process.env.API_KEY}`,
});
The ViemSigner
class is designed to facilitate signing Ethereum transactions and messages using a MpcAuthenticator for key management. This signer integrates with the viem library to provide a seamless signing experience.
An example of ViemSigner
with Pimlico
account creation:
// ViemSigner initialization
const client = await ViemSigner.instance(mpcAuth);
const signer = await client.getViemAccount();
const walletClient = createWalletClient({
account: signer,
chain: sepolia,
transport: http(
`https://rpc.zerodev.app/api/v2/bundler/${process.env.API_KEY}`
),
});
const smartAccountSigner = walletClientToSmartAccountSigner(walletClient);
The library provides the following error codes:
enum BaseErrorCode {
StorageWriteFailed = 1,
StorageFetchFailed = 2,
HttpError = 3,
// Action errors
PairingFailed = 4,
KeygenFailed = 5,
BackupFailed = 6,
SignFailed = 7,
RecoverFailed = 8,
KeygenResourceBusy = 9,
SignResourceBusy = 10,
InternalLibError = 11,
PhoneDenied = 12,
InvalidBackupData = 13,
InvalidMessageHashLength = 14,
WalletNotCreated = 15,
UnknownError = 16,
}
git clone https://github.com/silence-laboratories/mpc-account-abstraction-sdk.git
cd ./mpc-account-abstraction-sdk
npm i
cd ./packages/mpc
npm run build
FAQs
Universal MPC Authenticator SDK
We found that @silencelaboratories/universal-mpc-auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.