
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
(in alphabetical order)
It's recommended to use a Node version as same as Electron is running with (currently: Electron v9.1.2
/ Node 12.14.1
)
git clone https://github.com/thorchain/asgardex-electron.git asgardex
cd asgardex
yarn
While environment variables are not required (defaults are set), you can configure them. Create an .env
file by copying all content of .env.sample
and change these for your needs.
main
process (only once or whenever you change something in preload.ts
or electron.ts
)yarn prebuild
renderer
process and run application in watch
modeyarn dev
In case Node@12 might run into memory issues locally set --max-old-space-size
as follow:
export NODE_OPTIONS="--max-old-space-size=4096"
Use REACT_APP_WALLET_PASSWORD
to run the app by replacing password
with your own password
REACT_APP_WALLET_PASSWORD=password yarn dev
Or add to REACT_APP_WALLET_PASSWORD=password
to .env
file and run yarn dev
Add chains you want to have for development to REACT_APP_CHAINS_ENABLED
, for example
REACT_APP_CHAINS_ENABLED=THOR,BNB,BTC,ETH,LTC
Note: String of chains have to be as same as definitions in xchain-util
unit
yarn test
e2e
Note: e2e tests are disabled temporary (see #750)
yarn test:e2e
lint
yarn lint
Note: eslint
is provided by react-scripts
located in ./node_modules/react-scripts/node_modules/
and don't need to be extra installed. If your editor has some issues to find eslint
, you might point it to this location (see VSCode settings file as an example).
visualize the bundle map using source-map-explorer
yarn analyze
src
src
├── index.ts # entry point for CRA
├── main # sources of Electron's main process
├── renderer # sources of Electron's renderer process (aka webapp)
└── shared # shared sources for Electron's main and renderer processes
src/main
(Electron's "main" app)src/main
├── electron.ts # entry point
├── i18n # internationalization (needed for menus)
└── menu # "native" menus
src/renderer
(Electron's "renderer" app aka ReactJS webapp)src/renderer
├── assets # static files (svg, fonts etc.)
├── components # basic components
├── contexts # React contexts to provide "global" accessible states (RxJS based)
├── helpers # helper functions
├── hooks # custom hooks
├── i18n # internationalization (translations etc.)
├── index.tsx # entry point
├── routes # routing
├── services # RxJS based IO handler and states (consumed by contexts)
├── types # TypeScript types (e.g. generated types for Midgard API)
└── views # "Container" components
ASGARDEX follows security recommendation made by Electron team, such as:
EXTERNALS_WHITELIST
, all others are blocked. This list has to be extended if needed.Important note for macOS
users: Please follow guide of "How to package ASGARDEX
on macOS" before running following command.
yarn package:electron
By creating a new wallet or importing an existing one, ASGARDEX is saving wallet's phrase encrypted in keystore.json
on your machine in Electron's appData
folder at following location:
# ASGARDEX installed from *.exe
%APPDATA%/ASGARDEX/storage/keystore.json
# ASGARDEX built and run locally
%APPDATA%/Electron/storage/keystore.json
# ASGARDEX installed from *.dmg
~/Library/Application Support/ASGARDEX/storage/keystore.json
# ASGARDEX built and run locally
~/Library/Application Support/Electron/storage/keystore.json
# ASGARDEX installed from *.deb
~/.config/ASGARDEX/storage/keystore.json
# ASGARDEX built and run locally
~/.config/Electron/storage/keystore.json
keystore.json
can be removed in ASGARDEX by clicking "Remove wallet" in Wallet -> Settings
or by removing it manually.
See RELEASE.md
See the docs and guides here
Please see the Contributing Guidelines here (coming soon).
Please see the Bug Report Process here (coming soon).
MIT THORChain
FAQs
WALLET AND EXCHANGE CLIENT FOR THORCHAIN
The npm package asgardex receives a total of 0 weekly downloads. As such, asgardex popularity was classified as not popular.
We found that asgardex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.