
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
bitcoin-script-eval
Advanced tools
Evaluates Bitcoin Scripts, according to the specification of Bitcoin SV.
Evaluates Bitcoin Scripts, according to the specification of Bitcoin SV.
npm i --save bitcoin-script-eval
The standard usage is to evaluate a script and examine its result.
const bitcoinScriptEval = require("bitcoin-script-eval");
bitcoinScriptEval("ff f1 OP_CAT 01 OP_SPLIT", "asm").then((context) => {
context.stack; // a Buffer array with values [ ff, f1 ]
context.altStack; // a Buffer array with all values in the altStack at the end of the script
context.opReturn; // a Buffer array with all values following an OP_RETURN that got executed
context.ended; // boolean that gets set to TRUE once the evaluation ends
context.interrupted; // boolean that gets set to TRUE if the evaluation ended with an interruption.
context.endedWithOpReturn; // boolean that gets set to TRUE if the evaluation ended with an OP_RETURN.
context.endMessage; // string explaining what interrupted the script (Error message or "OP_RETURN").
context.done; // boolean that gets set to TRUE once the evaluation ends without interruption
context.blocks; // details about unfinished OP_IF blocks
});
An alternative usage is to split the execution into chunks. This makes it possible to evaluate the state of the script after each chunk.
To continue the evaluation from where the previous script ended, simply pass on the exact same context object to the evaluation.
const bitcoinScriptEval = require("bitcoinScriptEval");
const context1 = await bitcoinScriptEval("ff f1", "asm"); // stack is [ff, f1]
const context2 = await bitcoinScriptEval("OP_CAT", "asm", context1); // stack is [fff1]
const context3 = await bitcoinScriptEval("01 OP_SPLIT", "asm", context2); // stack is [ff, f1]
Here are some rules about splitting scripts into chunks:
Some parts of the library are not complete, like signature validation.
As a workaround, set:
context.sigsAlwaysPass = true;
This will make all Sig opcodes consume the same stack variables, but without checking if the sigs are valid.
sigsAlwaysPassisFALSEby default.
By default, this tool supports disabled opcodes. If you want it to fail on disabled opcodes instead, set:
context.failOnDisabled = true;
This code is provided AS-IS, without any warranty. See the license.
FAQs
Evaluates Bitcoin Scripts, according to the specification of Bitcoin SV.
We found that bitcoin-script-eval demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.