Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
bc-ledger-libs
Advanced tools
This repository hosts libraries to communicate with Ledger Nano / Nano S / Blue applications. There are implementations for Node and Browser.
Package | Version | Description |
---|---|---|
create-dapp | Ledger DApp Ethereum starter kit | |
@ledgerhq/web3-subprovider | web3 subprovider implementation for web3-provider-engine | |
Apps | ||
@ledgerhq/hw-app-eth | Ethereum Application API | |
@ledgerhq/hw-app-btc | Bitcoin Application API | |
@ledgerhq/hw-app-xrp | Ripple Application API | |
@ledgerhq/hw-app-str | Stellar Application API | |
@ledgerhq/hw-app-ada | Cardano ADA Application API | |
Transports | ||
@ledgerhq/hw-transport-node-hid | Node implementation of the communication layer, using node-hid (USB) | |
@ledgerhq/hw-transport-u2f | Web implementation of the communication layer, using U2F api | |
@ledgerhq/react-native-hw-transport-ble | BLE bluetooth for react-native communication layer | |
@ledgerhq/react-native-hid | USB hid for react-native communication layer | |
@ledgerhq/hw-transport-http | communicate to the device over HTTP. NB: DEV & testing purpose only. DO NOT use in PROD | |
@ledgerhq/hw-transport | The generic interface of the communication layer | |
Development Tools | ||
@ledgerhq/hw-http-proxy-devserver | HTTP server proxy to use with hw-transport-node-hid NB: DEV & testing purpose only. DO NOT use in PROD | |
@ledgerhq/hw-hid-cli | CLI utility to send APDU to the device via node-hid | |
@ledgerhq/hw-transport-mocker | Tool used for test to record and replay APDU calls. |
Basic example:
import Transport from "@ledgerhq/hw-transport-node-hid";
// import Transport from "@ledgerhq/hw-transport-u2f"; // for browser
import AppBtc from "@ledgerhq/hw-app-btc";
const getBtcAddress = async () => {
const transport = await Transport.create();
const btc = new AppBtc(transport);
const result = await btc.getWalletPublicKey("44'/0'/0'/0/0");
return result.bitcoinAddress;
};
getBtcAddress().then(a => console.log(a));
When using in a browser, make sure to set up "Browser mode" in the application settings on the device if available.
More advanced examples:
Please read our contribution guidelines before getting started.
You need to have a recent Node.js and Yarn installed.
yarn
Build all packages
yarn build
Watch all packages change. Very useful during development to build only file that changes.
yarn watch
Lint all packages
yarn lint
First of all, this ensure the libraries are correctly building, and passing lint and flow:
yarn test
then to test on a real device...
Plug a device like the Nano S and open Bitcoin app.
Then run the test and accept the commands on the devices for the tests to continue.
yarn test-node
You can also test on the web:
yarn test-browser
make sure to configure your device app with "Browser support" set to "YES".
Checklist before deploying a new release:
npm login
once (check npm whoami
)git config remote.$(git config branch.master.remote).url
and fix it with git branch --set-upstream master origin/master
)git pull
) and there is no changes in git status
yarn
once, there is still no changes in git status
deploy a new release
yarn run publish
then, go to /releases and create a release with change logs.
alternatively:
deploy a canary release (beta, etc)
yarn run publish -- -c beta
NB: if there is a new package, AFAIK you need to manually
npm publish
it once on NPM.
FAQs
| Package | Version | Descriptio
We found that bc-ledger-libs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.