
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
basil-tezos-ledger
Advanced tools
Library for Ledger Hardware Wallets.
Github, API Doc, Ledger Devs Slack
Here is a sample app for Node:
let Transport = require("@ledgerhq/hw-transport-node-hid").default;
let App = require("@ledgerhq/hw-app-xtz").default;
const getAddress = async () => {
const transport = await Transport.create();
const xtz = new App(transport);
const result = await xtz.getAddress("44'/1729'/0'/0'", true);
return result.publicKey;
};
const signOperation = async () => {
const transport = await Transport.create();
const xtz = new App(transport);
const result = await xtz.signOperation("44'/1729'/0'/0'", "0342397c7a82e1f7509513642e573020aeb0aea36ac087139085e42d480cd08520070000d2e495a7ab40156d0a7c35b73d2530a3470fc8700002000000cda3081bd81219ec494b29068dcfd19e427fed9a66abcdc9e9e99ca6478f60e9080000d2e495a7ab40156d0a7c35b73d2530a3470fc870d0860303c80100c0ba99060000e7670f32038107a59a2b9cfefae36ea21f5aa63c00");
return result.signature;
};
const getVersion = async () => {
const transport = await Transport.create();
const xtz = new App(transport);
const versionInfo = await xtz.getVersion();
return versionInfo;
};
const doAll = async () => {
version = await getVersion();
console.log(version);
address = await getAddress();
console.log(address);
signature = await signOperation();
console.log(signature);
};
doAll().catch(err => console.log(err));
To get this to work with a dev checkout of the LedgerJS repo, make sure that
you have appropriate dependencies in your package.json
, either by using
yarn add file:.../path
or yarn link
. Make sure that you yarn install
and yarn build
the LedgerJS packages, as yarn build
will be necessary
to translate the Javascript into a form acceptable by Node.
If you want to use web instead, replace hw-transport-node-hid
with hw-transport-u2f
and run npx webpack
.
FAQs
For short term development purposes only
The npm package basil-tezos-ledger receives a total of 0 weekly downloads. As such, basil-tezos-ledger popularity was classified as not popular.
We found that basil-tezos-ledger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.