
Research
/Security News
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
@tallyho/keyring-controller
Advanced tools
A module for managing keyrings, encrypting them, and using them across crypto networks.
A module for managing key material for multiple crypto networks, called "keyrings", useful for building and managing wallets.
Originally forked from the library to manage key material in MetaMask,
keyring-controller
has the additional goals of strict type safety, strong test
coverage, and greater cross-chain flexibility.
A KeyringController
has two main responsibilities:
npm install @tallyho/keyring-controller --save
import KeyringController from "@tallyho/keyring-controller"
import SimpleKeyring from "eth-simple-keyring"
const persistedVaults: string[] = []
const keyringController = new KeyringController({
keyringTypes: [SimpleKeyring], // optional array of types to support.
initState: { ... }, // Last emitted persisted state.
encryptor: {
// An optional object for defining encryption schemes:
// Defaults to Browser-native SubtleCrypto.
encrypt: async (password: string, data: any) => {
return "encrypted!"
},
decrypt: async (password: string, cipherText: string) => {
return { foo: "bar" }
},
},
persistVault: async (encryptedVault: string) => {
// toy example, it's up to the consumer to persist vaults somewhere safe!
persistedVaults.push(encryptedVault)
}
})
// The KeyringController is also an event emitter:
this.keyringController.on("newAccount", (address: string) => {
console.log(`New account created: ${address}`)
})
this.keyringController.on("removedAccount", handleThat)
To add new account types to a KeyringController
, just make sure it follows
the Keyring class protocol.
Currently the methods are heavily commented in the source, so it's the best place to look until we aggregate it here as well.
FAQs
A module for managing keyrings, encrypting them, and using them across crypto networks.
We found that @tallyho/keyring-controller demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
Security News
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.