Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
bc-ledger-libs
Advanced tools
This repository hosts libraries to communicate with Ledger Nano / Nano S / Blue applications. There are implementations for Node and Browser.
Package | Version | Description |
---|---|---|
create-dapp | Ledger DApp Ethereum starter kit | |
@ledgerhq/web3-subprovider | web3 subprovider implementation for web3-provider-engine | |
Apps | ||
@ledgerhq/hw-app-eth | Ethereum Application API | |
@ledgerhq/hw-app-btc | Bitcoin Application API | |
@ledgerhq/hw-app-xrp | Ripple Application API | |
@ledgerhq/hw-app-str | Stellar Application API | |
@ledgerhq/hw-app-ada | Cardano ADA Application API | |
Transports | ||
@ledgerhq/hw-transport-node-hid | Node implementation of the communication layer, using node-hid (USB) | |
@ledgerhq/hw-transport-u2f | Web implementation of the communication layer, using U2F api | |
@ledgerhq/react-native-hw-transport-ble | BLE bluetooth for react-native communication layer | |
@ledgerhq/react-native-hid | USB hid for react-native communication layer | |
@ledgerhq/hw-transport-http | communicate to the device over HTTP. NB: DEV & testing purpose only. DO NOT use in PROD | |
@ledgerhq/hw-transport | The generic interface of the communication layer | |
Development Tools | ||
@ledgerhq/hw-http-proxy-devserver | HTTP server proxy to use with hw-transport-node-hid NB: DEV & testing purpose only. DO NOT use in PROD | |
@ledgerhq/hw-hid-cli | CLI utility to send APDU to the device via node-hid | |
@ledgerhq/hw-transport-mocker | Tool used for test to record and replay APDU calls. |
Basic example:
import Transport from "@ledgerhq/hw-transport-node-hid";
// import Transport from "@ledgerhq/hw-transport-u2f"; // for browser
import AppBtc from "@ledgerhq/hw-app-btc";
const getBtcAddress = async () => {
const transport = await Transport.create();
const btc = new AppBtc(transport);
const result = await btc.getWalletPublicKey("44'/0'/0'/0/0");
return result.bitcoinAddress;
};
getBtcAddress().then(a => console.log(a));
When using in a browser, make sure to set up "Browser mode" in the application settings on the device if available.
More advanced examples:
Please read our contribution guidelines before getting started.
You need to have a recent Node.js and Yarn installed.
yarn
Build all packages
yarn build
Watch all packages change. Very useful during development to build only file that changes.
yarn watch
Lint all packages
yarn lint
First of all, this ensure the libraries are correctly building, and passing lint and flow:
yarn test
then to test on a real device...
Plug a device like the Nano S and open Bitcoin app.
Then run the test and accept the commands on the devices for the tests to continue.
yarn test-node
You can also test on the web:
yarn test-browser
make sure to configure your device app with "Browser support" set to "YES".
Checklist before deploying a new release:
npm login
once (check npm whoami
)git config remote.$(git config branch.master.remote).url
and fix it with git branch --set-upstream master origin/master
)git pull
) and there is no changes in git status
yarn
once, there is still no changes in git status
deploy a new release
yarn run publish
then, go to /releases and create a release with change logs.
alternatively:
deploy a canary release (beta, etc)
yarn run publish -- -c beta
NB: if there is a new package, AFAIK you need to manually
npm publish
it once on NPM.
FAQs
| Package | Version | Descriptio
The npm package bc-ledger-libs receives a total of 1 weekly downloads. As such, bc-ledger-libs popularity was classified as not popular.
We found that bc-ledger-libs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.