
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
bitcore-polis
Advanced tools
Infrastructure to build Polis and blockchain-based applications for the next generation of financial technology.
Note: If you're looking for the Bitcore-Polis Library please see: https://github.com/polisevo/bitcore-lib-polis
Before you begin you'll need to have Node.js v4+ installed. There are several options for installation. One method is to use nvm to easily switch between different versions, or download directly from Node.js.
npm install -g bitcore-polis
Spin up a full node and join the network:
npm install -g bitcore-polis
bitcored
You can then view the Insight block explorer at the default location: http://localhost:3001/insight, and your configuration file will be found in your home directory at ~/.bitcore.
Create a transaction:
var bitcore = require('bitcore-polis');
var transaction = new bitcore.Transaction();
var transaction.from(unspent).to(address, amount);
transaction.sign(privateKey);
The complete docs are hosted here: bitcore documentation. There's also a bitcore API reference available generated from the JSDocs of the project, where you'll find low-level details on each bitcore utility.
To get community assistance and ask for help with implementation questions, please use our community forums.
We're using Bitcore in production, as are many others, but please use common sense when doing anything related to finances! We take no responsibility for your implementation decisions.
If you find a security issue, please email security@bitpay.com.
Please send pull requests for bug fixes, code optimization, and ideas for improvement. For more information on how to contribute, please refer to our CONTRIBUTING file.
This will generate files named bitcore.js and bitcore.min.js.
Released under the MIT license, under the same terms as PolisCore itself. See LICENSE for more info.
FAQs
A platform to build Polis and blockchain-based applications.
We found that bitcore-polis demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.