Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@trezor/connect-webextension
Advanced tools
High-level javascript interface for Trezor hardware wallet in webextension serviceworker environment.
The @trezor/connect-webextension package provides an implementation of @trezor/connect designed specifically for use within web extensions. Key features include:
We support two methods for integrating the library into your extension:
For a seamless integration, especially with background processes, modify your extension's manifest.json
to include scripting permissions, specify host_permissions
, and define your service worker script as shown below:
"permissions": ["scripting"],
"host_permissions": ["*://connect.trezor.io/9/*"]
"background": {
"service_worker": "serviceWorker.js"
},
The content script will be injected automatically by the library using the scripting permission.
In your serviceWorker.js
, use importScripts to import the library. Ensure you replace <path>
with the actual path to the library file:
importScripts('<path>/trezor-connect-webextension.js');
Or if you're using ES modules:
import TrezorConnect from '@trezor/connect-webextension';
The library is only available in the service worker context, so to use it in your extension's UI, you need to communicate with the service worker. This mechanism is not provided by the library, this depends on your extension's architecture. Also it should be noted that the service worker may be idle when the extension is not in use, so you should implement a mechanism to keep it alive or wake it up when needed.
In cases where you cannot use scripting permissions, you can configure your extension to include the content script directly.
Manually include build/content-script.js
from this package into your project's bundle.
Ideally, you should do this with a build tool like Webpack, so it can be easily maintained.
Amend your manifest.json to include the script as a content script. Replace <path>
with the real path to the library file:
"content_scripts": [
{
"js": ["<path>/content-script.js"],
"matches": ["*://connect.trezor.io/9/*"]
}
],
After completing these steps, you can use the module in your Service Worker in the same way as described in the previous section.
knownHosts
To ensure your extension is displayed with its name rather than its ID, you need to open a Pull Request to include it in the knownHosts
section of the file located at https://github.com/trezor/trezor-suite/blob/develop/packages/connect/src/data/config.ts#L17.
yarn
yarn build:libs
yarn workspace @trezor/connect-webextension build
yarn workspace @trezor/connect-iframe build:core-module
yarn workspace @trezor/connect-popup dev
After completing these steps, you can import from @trezor/connect-webextension or directly use the built file build/trezor-connect-webextension.js
.
The popup will run on your localhost, and you can specify it in the TrezorConnect.init({ connectSrc: ... })
.
FAQs
High-level javascript interface for Trezor hardware wallet in webextension serviceworker environment.
The npm package @trezor/connect-webextension receives a total of 204 weekly downloads. As such, @trezor/connect-webextension popularity was classified as not popular.
We found that @trezor/connect-webextension demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.