
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
npm i asset-js --save
Usage:
const asset = require("asset-js")(gethandler, sethandler, defaults, deleteHandler, autosave)
let myasset = await asset("asset1", defaultValue?, persistent /*persistent = available forever, never uncached, useful for assets used regularly like a config file*/)
myasset.someproperty = "a"
//gets saved automatically after a while
//or save everything manually:
asset.save()
Example:
const fs = require("fs")
function default(assetID){ //Gets called if a certain asset is not found (ie a default value)
if(assetID.startsWith("user/")){ //if assetID is in user folder
return { //return default userdata
username:"",
timeCreated:Date.now()
}
}else return {} //otherwise, return an empty object
}
function get(name){
return JSON.parse(fs.readFileSync(name))
}
function set(name, data){
fs.writeFileSync(name, JSON.strinify(data))
}
const asset = require("asset-js")(get, set, default, fs.unlinkSync, 900000 /*autosave every 900000ms, or 15mins*/)
var john = asset("user/john")
john.username = "johnny_english"
var configuration = asset("config.json", {} /*default value: function default() is ignored in this case*/)
configuration.allowRetards = false
asset.save() //optional because we have autosave
You can load custom pre-made wrapping functions (presets) to save yourself some time, for example, for firebase: (use asset-js-firestore
)
const asset = require("asset-js")(
require("asset-js-firestore")(collectionName, credentials, default)
//connnects to FIRESTORE!
)
Typically, assetdb presets on npm are named something like asset-js-XXX
, if you wish to make one, please use that format, as it will help users determine what the preset is made for.
FAQs
DB caching manager
The npm package asset-js receives a total of 0 weekly downloads. As such, asset-js popularity was classified as not popular.
We found that asset-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.