
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@swan-bitcoin/bdk-node
Advanced tools
This package is a wrapper around the [Bitcoin Dev Kit](https://bitcoindevkit.org/getting-started/) made with [Napi-RS](https://napi.rs/docs/).
This package is a wrapper around the Bitcoin Dev Kit made with Napi-RS.
npm install @swan-bitcoin/bdk-node
# or
yarn add @swan-bitcoin/bdk-node
# or
pnpm install @swan-bitcoin/bdk-node
import {Bdk} from '@swan-bitcoin/bdk-node'
_bdk = new Bdk()
const height = await _bdk.estimateFee(
host,
numBlocks,
)
The Rust code that gets built is inside src/lib.rs. When you run pnpm build
this file gets compiled and NAPI spit out the Typescript file and JS with the
bindings.
Napi comes out of the box with a release process that is documented here.
To publish a new version of the package you need to:
Make sure you start on the main branch and main is up-to-date
git checkout main
git pull
Check out a new branch and give it a good name using /, such as:
git checkout -b jdf/publish-new-package-version
major and minor can also be used in place of patch (if appropriate)npm version patch
git push --follow-tags
The workflow will need to be approved by another user with write access before its executed. If published successfully, the packages will be published here.
Check out: https://github.com/turkycat/fulcrum-regtest
from fulcrum-regtest/
docker compose up -d
./prepare_btc1.sh
./send_to_address.sh bcrt1q8vw3juyk7gm7elt8rut87mghe50sxc32njs7zn9fqv6ynsxr52xq4h2uu0 10
./mine_blocks.sh 1
the above commands will:
for some extra fun:
docker logs -f fulcrum - watch fulcrum as it processes new blocks, receives transactions, and other stuff
docker exec -it btc1 /bin/bash - execute commands with bitcoin-cli
BDK instructions:
to interact with this wallet in BDK use the following command:
bdk-cli --network regtest repl --server localhost:50001 --descriptor "wsh(multi(2,[5708531c/84h/1h/0h/2h]tpubDFE8F7LxXBEQEMPxed7QxhUJn6HMZg9keYLiXTCFbAkP3bRAneGZjNW44gwWcVj8yzwE9F7i55m78ZqdVsrmdJXXsh2iZCHjoon7LRAjXcu/0/*,[946d4c49/84h/1h/0h/2h]tpubDFXJS31fJep45UaMw4EUUqNhL6qUYL3BUW5TuHyXn4A4yCkXcJMy7ba6uT9cqX6KjMBgeVRqb56TuQ5oRxW5QUQ3ffhMqEy44ECvyxhwUFk/0/*,[4c69896e/84h/1h/0h/2h]tpubDE159ZNvnVj5Dv7Eo8EmnTjUdvJZYQ8fNp7R3K29a5FjZkmd4priKbdePGWU7XJMERG7LPQnh3Fi7Hjv1JrmXUrxuNaWXfULj8hDG7biXqh/0/*))" --change_descriptor "wsh(multi(2,[5708531c/84h/1h/0h/2h]tpubDFE8F7LxXBEQEMPxed7QxhUJn6HMZg9keYLiXTCFbAkP3bRAneGZjNW44gwWcVj8yzwE9F7i55m78ZqdVsrmdJXXsh2iZCHjoon7LRAjXcu/1/*,[946d4c49/84h/1h/0h/2h]tpubDFXJS31fJep45UaMw4EUUqNhL6qUYL3BUW5TuHyXn4A4yCkXcJMy7ba6uT9cqX6KjMBgeVRqb56TuQ5oRxW5QUQ3ffhMqEy44ECvyxhwUFk/1/*,[4c69896e/84h/1h/0h/2h]tpubDE159ZNvnVj5Dv7Eo8EmnTjUdvJZYQ8fNp7R3K29a5FjZkmd4priKbdePGWU7XJMERG7LPQnh3Fi7Hjv1JrmXUrxuNaWXfULj8hDG7biXqh/1/*))"
then, in the REPL you can do the following interesting things
wallet get_new_address- returns the next unused address ( which will be bcrt1q8vw3juyk7gm7elt8rut87mghe50sxc32njs7zn9fqv6ynsxr52xq4h2uu0 [index 0] if used before wallet sync or before spending)
wallet sync
wallet get_balance - need to sync first to get accurate info
help
wallet help
bdk-cli will create a local database in ~/.bdk-bitcoin by default, so you may need to clean those up if you need to restart.
FAQs
This package is a wrapper around the [Bitcoin Dev Kit](https://bitcoindevkit.org/getting-started/) made with [Napi-RS](https://napi.rs/docs/).
We found that @swan-bitcoin/bdk-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.