
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@transia/secret-numbers
Advanced tools
Generate XRPL Accounts with a number-based secret: 8 chunks of 6 digits
For more background information, please read the proposed Standard.
A tool to convert Secret Numbers to the widely used Family Seed s... format is available here
A bundled version of this lib is available at NPM (build/xrplf-secret-numbers-latest.js), CDN: https://cdn.jsdelivr.net/npm/@xrplf/secret-numbers. You can access the library as xrplf_secret_numbers. Sample:
https://jsfiddle.net/WietseWind/uo1zy0q7/
The common formats for XRPL account secrets are (at the time of writing this, July 2019):
sh1HiK7SwjS1VxFdXi7qeMHRedrYXcar banana apple road ...These formats are prone to typo's and not that user friendly. Using numbers means it's language (spoken, written) agnostic as well. They may be especially intimidating for the public that's relatively new to cryptocurrencies / blockchain technology.
This library encodes the entropy to generate accounts into 8 chunks of 6 digits, of which 5 digits are 1/8th of the entropy, and a 6th digit contains a checksum allowing realtime typo detection.
554872 394230 209376 323698
140250 387423 652803 258676
For compatibility with existing clients, this library supports exporting the family seed for a generated / entered "Secret Number"-set as well.
The typescript code to use resides in ./src/ and the compiled js in ./dist/ of the package. See the ./samples/ folder for some simple JS samples.
const {Account} = require('@xrplf/secret-numbers')
const account = new Account()
const {Account} = require('@xrplf/secret-numbers')
const secret = '399150 474506 009147 088773 432160 282843 253738 605430'
const account = new Account(secret)
Or importing with custom entropy (buffer, 16):
const {Account} = require('@xrplf/secret-numbers')
const entropy = Buffer.from('0123456789ABCDEF0123456789ABCDEF', 'hex')
const account = new Account(entropy)
You can fetch the account details (address, secret, etc.) using these methods:
console.log(account.getAddress())
console.log(account.getSecret())
getSecret(): Array[8]getSecretString(): string 012345 456789 ...getAddress(): string rXXXXXXXX...getFamilySeed(): string sXXXXXXXX...getKeypair(): Keypair({privateKey, publicKey}There's a Utils export as well:
const {Account, Utils} = require('@xrplf/secret-numbers')
Some Utils methods (that you may want to use in your UI / ... before using the Account constructor):
calculateChecksum(position: number, value: number): numbercheckChecksum(position: number, value: number | string, checksum?: number): BooleanRun npm run prepublish to clean, lint, test and build. Or just run npm run build, npm run test or npm run lint.
Tests are in ./test/
This concept is based on an idea by @nbougalis.
FAQs
Generate XRPL Accounts with a number-based secret: 8 chunks of 6 digits
We found that @transia/secret-numbers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.