
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@tokel/nspv-js
Advanced tools
Client-side Bitcoin JavaScript library with Komodo cryptocondions support
A javascript nSPV library for node.js and browsers. Written in javascript with the cryptoconditions (cc) library written in rust and built as a wasm module.
This javascript library allows to develop nSPV clients using Antara (CC) technology.
More info: Antara Development Docs
Released under the terms of the MIT LICENSE.
It allows easy and quick communication with notarized blockchains.
nSPV does not require downloading the whole blockchain in order for it to work.
It is secure and all transactions are created and signed locally
There is no 3d party involved. You run an nSPV node, you communicate with the blockchain, you receive data. No one else is involved.
SPV clients are very useful for wallets that dont want the entire blockchain locally, however as the blockchains grow in length, the number of headers required grows linearly. With equihash coins, the header size is 2kb, so this effect becomes quite a large overhead, ie. 2GB per million blocks. Just for the headers!
If we are willing to use the notarizations as a verified blockhash, we can reduce the number of headers required to just the headers that are in the blocks near the utxo in a specific wallet. As little as 10 headers would be needed to get full confirmation on a specific utxo. Continue reading...
SPV technology Bitcoin Wiki - SPV
nSPV a simple approach to superlight clients leveraging notarizations
Komodo docs nSPV
You can use the library in your node server or in the browser only application.
const { networks } = require('@tokel/nspv-js');
const network = networks.tkltest;
const { networks } = require('@tokel/nspv-js');
const network = networks.tkltest;
npm i @tokel/nspv-js
Clone this git repository go to the new dir and checkout development
branch.
Install the nspv-js dependency packages.
npm install
In the samples folder are included a several examples of CC usage.
To test this you need a komodod chain with cc modules enabled (Note about the correct komodod repo with an nspv patch, see below)
To run the test app in the browser you will need a webserver to host an html sample page and the test app ccfaucetpocbr.js. Also you need a websocket proxy to convert websockets into nspv p2p protocol.
I use the webpack dev server running in nodejs.
To setup a webpack sample config make a dir like 'webpack' and create inside it two files with the following content:
package.json:
{
"scripts": {
"serve": "webpack-dev-server"
},
"dependencies": {
"cryptoconditions-js": "@tokel/cryptoconditions"
},
"devDependencies": {
"webpack": "^4.44.2",
"webpack-cli": "^3.3.12",
"webpack-dev-server": "^3.11.0"
}
}
webpack.config.js:
const path = require('path');
module.exports = {
entry: "./ccfaucetpocbr.js",
output: {
path: path.resolve(__dirname, "dist"),
filename: "ccfaucetpocbr-bundle.js",
library: 'myLibrary'
},
mode: "development",
//to serve from any external address (do not add this devServer config to serve only locally):
devServer: {
port: 8080,
host: '0.0.0.0'
}
};
(Both those package.json and webpack.config.js files may be found in webpack-test subdir of bitgo-komodo-cc-lib dir) Inside the webpack dir run:
npm install
(ignore printed errors)
Set again the nightly rust version for this repo:
rustup default nightly
Now go to nspv-js repo dir.
Rebuild sources and build the test app for browser:
npm run build
browserify ./samples/ccfaucetpoc.js --standalone faucet -o ccfaucetpocbr.js
Copy created ccfaucetpocbr.js into your webpack dir. Copy the example of an index.html page from the webpack-test dir to your webpack dir. Inside your webpack dir run the web server with a command:
npm run serve
The web server should be available at http://localhost:8080 url (if you installed the webpack on the same PC).
The last thing is to make sure you run a komodod version with an extension to nSPV getutxos call (it should additionally return script for each utxo).
https://github.com/TokelPlatform/komodo tokel branch
I recommed to run komodod with -debug=net to easily discover wrong magic errors and observe communication dynamic. Basically komodod should print ver/verack and ping/pong exchanges in the debug.log, if connection is okay
When you run the chain, webpack and webcoin-bridge, you might go to the test page url in browser (http://localhost:8080).
It allows first to connect to a peer and then create cc faucet transactions.
Some dependent packages were modified to add support for komodo:
Links to these packages in package.json are updated to load them from forked github repositories (see package.json).
Also added a new package cryptoconditions-js link that currently is loaded from a github repo.
Read the original readme here.
FAQs
Client-side Bitcoin JavaScript library with Komodo cryptocondions support
We found that @tokel/nspv-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.