
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@syscoinorg/syscoin-nodejs
Advanced tools
Prior to running the server a Syscoin node must be installed and properly configured as a JSON-RPC server. After the full node is configured the syscoin-api server needs to know the location of syscoin.conf using the `SYS_LOCATION` environmental variable
Prior to running the server a Syscoin node must be installed and properly configured as a JSON-RPC server. After the full node is configured the syscoin-api server
needs to know the location of syscoin.conf using the SYS_LOCATION environmental variable, replacing DATALOCATION in the examples below
with the path to your Syscoin data directory, including the trailing slash.
To run the server, follow these simple steps:
npm install
SYS_LOCATION=DATALOCATION npm run start
Running the server in daemon mode is dependent on pm2. To run the server as a daemon
use the below command after npm install completes:
SYS_LOCATION=DATALOCATION npm run startd
Syscoin API has a series of "sanity" unit tests written using the Mocha + Chai test framework and assertions library. Due to the confirmation-based nature of blockchain transactions and for ease of use, you must first create a few Syscoin services manually and use the data from these to configure the test, before running the tests.
Follow the steps below before running the test suite:
First ensure your wallet is running on a working testnet as the test suite will spend SYS in its execution. You can do this by
editing syscoin.conf and specifying testnet=1.
Transfer at least 100 syscoin to the root wallet address (can be acquired by running getaccountaddress "" via syscoind
or QT debug console)
Manually create the following entities on the Syscoin network, and populate the result values mentioned below into
server/nodejs/spec/config.js:
TEST_ALIAS and TEST_ALIAS_PASSWORD to the alias and password.TEST_ALIAS and set TEST_OFFER_GUID to the guid of the new offer.TEST_ALIAS, and set TEST_CERT_GUID to the guid of the new cert.TEST_ALIAS to TEST_ALIAS, and set TEST_MESSAGE_GUID to the guid of the new message.TEST_ALIAS as buyer and arbiter, purchasing TEST_OFFER_GUID, and set TEST_ESCROW_GUID to the guid of the new escrow.Run the test suite using the commend below, ensuring both Syscoin API Server and the Syscoin Core RPC Server are running.
npm run test
Note: Depending on network variables some tests may fail due to lack of confirmation on transactions/operations earlier in
the test suite. The test try to accomodate this by waiting 3mins for confirmations around these confirmation-sensitive
transaction types. These are typically offerAccept and offerAcceptFeedback tests. Additionally if the TEST_* identifiers
you're using in Config.js have large result lists you may need to modify the specifics tests by adding a this.timeout(n) where n
represents a time in ms that allows for the full response to be returned. The default is 2000ms.
Before deploying syscoin-api for production use you will need to modify the following files:
host value in /api/swagger.yamlswaggerSpec.host value located in ../../swagger-ui/dist/swagger-spec.jsHOST value in /spec/config.jsIn all these files modify the specified value from localhost:8001 to SERVERIP:8001. Replacing SERVERIP with your server's
production IP or domain. You can also optionally change the port.
It is highly recommended that you allow only HTTPS access in production deployments and secure all connections with a valid SSL certificate. Failure to do this can expose the wallet to attack.
FAQs
Prior to running the server a Syscoin node must be installed and properly configured as a JSON-RPC server. After the full node is configured the syscoin-api server needs to know the location of syscoin.conf using the `SYS_LOCATION` environmental variable
We found that @syscoinorg/syscoin-nodejs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.