
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@zk-email/contracts
Advanced tools
DKIMRegistry.sol is a Solidity contract within the @zk-email/contracts package, functioning as a registry for storing hashes of DKIM public keys associated with particular domains.
Registering DKIM Public Key Hashes: Developers can use the contract to register new hashes of DKIM public keys for a domain, so that any email sent from the domain can be verified against the blockchain-stored hash.
Validating DKIM Public Key Hashes: The contract allows for the validation of a registered DKIM public key hash. This helps verify if the public key in an email matches the one registered in the blockchain for the domain, confirming the email's authenticity.
Revoking Compromised Keys: In the event of a security breach or compromise of a private key, developers can revoke the associated DKIM public key hash to prevent misuse.
For a detailed overview of its functionalities, please refer to the source file: DKIMRegistry.sol
UserOverrideableDKIMRegistry.sol is a Solidity contract within the @zk-email/contracts package.
This functions similarly to DKIMRegistry, but it allows users to set their own public keys. Even if the main authorizer, who is the contract owner, has already approved a public key, the user's signature is still required for setting it until the predetermined delay time has passed. Additionally, the public key can be revoked by the signature of either the user or the main authorizer alone.
UserOverrideableDKIMRegistry.sol
StringUtils.sol is a Solidity library that offers a range of string manipulation functions, including conversion between bytes and strings, and numerical string operations, for use across the @zk-email/contracts package.
uint256 to its ASCII string hexadecimal representation.string memory hexString = StringUtils.toHexString(12345, 4);
// hexString will be "0x3039"
toHexString but without the "0x" prefix.string memory hexStringNoPrefix = StringUtils.toHexStringNoPrefix(12345, 4);
// hexStringNoPrefix will be "3039"
uint256, bytes32, or address to a string.string memory uintToString = StringUtils.toString(uint256(12345));
string memory bytesToString = StringUtils.toString(bytes32("data"));
string memory addressToString = StringUtils.toString(address(0x123));
bool isEqual = StringUtils.stringEq("hello", "hello");
// isEqual will be true
string memory trimmedString = StringUtils.removeTrailingZeros("hello\x00\x00");
// trimmedString will be "hello"
uint256 values into a string, useful for handling compact data representations. 1 packed byte = 31 normal bytes.string memory upperString = StringUtils.upper("hello"); // "HELLO"
string memory lowerString = StringUtils.lower("HELLO"); // "hello"
FAQs
## DKIMRegistry.sol
The npm package @zk-email/contracts receives a total of 159 weekly downloads. As such, @zk-email/contracts popularity was classified as not popular.
We found that @zk-email/contracts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.