Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Bitboot allows a new node in a peer-to-peer network to find other nodes in the same network, even if the network being joined is as small as a single node. It has no local dependencies and doesn't require that any other local services be running.
npm install -g bitboot
bitboot <magic name>
The magic name
should be a unique string (make sure to use quotation marks if it's more than one word) for your network. If at least one other instance of bitboot is running somewhere else with the same magic name, then the program will print out other node's locations as they are found (one per line, in host:port
format). If you're just starting a new network, this may take a minute or two before other nodes are found.
var Bitboot = require('bitboot')
// The rally point name can be any string and should be unique
// to your peer network
var bb = new Bitboot('bitboot test network')
// this is called whenever the node selects a new ID and rejoins
// the BitTorrent mainline DHT network
bb.on('rejoin', function (nodeId) {
console.log('I have a new node id:', nodeId.toString('hex'))
})
// this is called whenever a search is made for peers
// peers will be the result of that search (and may be empty)
bb.on('peers', function (peers) {
console.log('I found peers:', peers)
})
bb.on('error', function (err) {
console.error(err)
})
Many peer-to-peer networks clients are initially bootstrapped by connecting to a handful of hard-coded, centralized nodes (yes, even Bitcoin and BitTorrent). Every new peer-to-peer network must solve this same challenge, usually by hardcoding centralized bootstrap servers. Bitboot allows you to avoid this step of having to run/maintain a new centralized server if you're creating a new p2p network. Bitboot can also be used more generally to find a single peer (for instance, if you just want to be able to find your home computer and the IP is changing frequently).
When you run bitboot, you give it a magic name to uniquely identify the network you'd like to join. Bitboot then joins the existing BitTorrent DHT (perhaps the largest and most reliable/stable DHT on the planet) and finds other nodes with the same magic name. It does this by selecting a rally point to hang out near based on the magic name where it will meet other nodes with the same magic name value. Also, the ID it uses is carefully selected so other nodes can pick it out as a bitboot peer based on the value of the magic name (in case other non-member nodes are hanging out around the rally point).
Note that while bitboot uses the BitTorrent DHT, it does not harm the existing network in any way (and, in fact, strengthens it by adding additional, fully functional nodes).
FAQs
Bootstrap a distributed p2p network
The npm package bitboot receives a total of 3 weekly downloads. As such, bitboot popularity was classified as not popular.
We found that bitboot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.