Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
autographed
Advanced tools
The self-building, hot-reloading subgraph. The quickest way to start indexing your shit.
npx autographed
The self-building, hot-reloading subgraph. The quickest way to start indexing your shit.
Okay, so there's a lot that goes into running a subgraph. The purpose of this library is to take care of most of that, and just get you to indexing your smart contract as quickly as possible.
Notice:
autographed
dynamically generates all the mappings and runtime architecture you need to quickly query for historical blockchain data emitted during smart contractevent
s. It is not suitable for writing custom indexing logic.
If this sounds like a good fit for you, you will need to make sure you have some of the following system dependencies available on your runtime.
First, please make sure you've installed and configured the Rust Toolchain:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
On top of that, you'll need to be able to run Docker Containers. The easiest way to do this is to download and install Docker Desktop.
With these steps out of the way, you'll finally need to install these final low-level dependencies:
ipfs jq gsed libpq cmake
Inside of your hardhat project root, create a .autograph.json
. This is what's used to control the name of the autogenerated subgraph, and which contracts in your local hardhat project you want to get indexed. You'll want to provide the addresses the contracts get deployed to when initializing your local chain.
{
"name": "MySubgraphName",
"sources": [
{
"contractName": "MyContractName",
"contractAddress": "0x..."
}
]
}
For a vanilla project configuration, an initial contract deployment transaction sent by (await ethers.getSigners())[0]
, commonly referred to as owner
, will be stored at the on-chain address 0x5FbDB2315678afecb367f032d93F642f64180aa3
.
There are some additional configuration options that can be used to tune the generator to your local runtime. By default, autographed
will use the following settings:
GRAPH_NODE_GRAPHQL_PORT=8000
GRAPH_NODE_STATUS_PORT=8020
IPFS_PORT=5001
POSTGRES_PORT=5432
ETHEREUM_PORT=8545
ETHEREUM_NETWORK=hardhat
POSTGRES_DB=dev
POSTGRES_USER=dev
POSTGRES_PASSWORD=dev
These can be overridden using environment variables i.e:
IPFS_PORT=420 ETHEREUM_PORT=6969 npx autographed
There's a ton of binary files that will need to be compiled on your first run. In the mean time, why don't you put on a cup of coffee or do some yoga or something? ☕️
If you'd like to build this repo yourself, just git clone
and run yarn
from the top-level directory. You can also use yarn test
to make sure everything's working okay or if you need to debug any issues you might will encounter.
FAQs
The self-building, hot-reloading subgraph. The quickest way to start indexing your shit.
The npm package autographed receives a total of 1 weekly downloads. As such, autographed popularity was classified as not popular.
We found that autographed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.