
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
bitspace-client
Advanced tools
Standalone BitSpace RPC client
npm install bitspace-client
const BitspaceClient = require('bitspace-client')
const client = new BitspaceClient() // connect to the Bitspace server
const chainstore = client.chainstore() // make a chainstore
const feed = chainstore.get(someUnichainKey) // make a unichain
await feed.get(42) // get some data from the unichain
const client = new BitspaceClient([options])Make a new Bitspace RPC client. Options include:
{
host: 'bitspace', // the ipc name of the running server
// defaults to bitspace
port // a TCP port to connect to
}
If port is specified, or host and port are both specified, then the client will attempt to connect over TCP.
If you only provide a host option, then it will be considered a Unix socket name.
await BitspaceClient.serverReady([host])Static method to wait for the local IPC server to be up and running.
status = await client.status([callback])Get status of the local daemon. Includes stuff like API version etc.
await client.close([callback])Fully close the client. Cancels all inflight requests.
await client.ready([callback])Wait for the client to have fully connected and loaded initial data.
chainstore = client.chainstore([namespace])Make a new remote chainstore. Optionally you can pass a specific namespace to load a specific chainstore. If you do not pass a namespace a random one is generated for you.
client.networkThe remote chainstore network instance.
client.replicate(chain)A one-line replication function for `Remote (see below for details).
The remote chainstore instances has an API that mimicks the normal chainstore API.
feed = chainstore.get([key])Make a new remote unichain instance. If you pass a key that specific feed is loaded, if not a new one is made.
feed = chainstore.default()Get the "default" feed for this chainstore, which is derived from the namespace.
feed.nameThe name (namespace) of this chainstore.
async feed.close([callback])Close the chainstore. Closes all feeds made in this chainstore.
The remote networker instance has an API that mimicks the normal chainstore networker API.
await network.ready([callback])Make sure all the peer state is loaded locally. client.ready calls this for you.
Note you do not have to call this before using any of the apis, this just makes sure network.peers is populated.
networks.peersA list of peers we are connected to.
network.on('peer-add', peer)Emitted when a peer is added.
network.on('peer-remove', peer)Emitted when a peer is removed.
await network.configure(discoveryKey | RemoteUnichain, options)Configure the network for this specific discovery key or RemoteUnichain. Options include:
{
lookup: true, // should we find peers?
announce: true, // should we announce ourself as a peer?
flush: true // wait for the full swarm flush before returning?
remember: false // persist this configuration so it stays around after we close our session?
}
const ext = network.registerExtension(name, { encoding, onmessage, onerror })Register a network protocol extension.
The remote feed instances has an API that mimicks the normal Unichain API.
feed.keyThe feed public key
feed.discoveryKeyThe feed discovery key.
feed.writableBoolean indicating if this feed is writable.
await feed.ready([callback])Wait for the key, discoveryKey, writability, initial peers to be loaded.
const block = await feed.get(index, [options], [callback])Get a block of data from the feed.
Options include:
{
ifAvailable: true,
wait: false,
onwait () { ... }
}
See the Unichain docs for more info on these options.
Note if you don't await the promise straight away you can use it to to cancel the operation, later using feed.cancel
const p = feed.get(42)
// ... cancel the get
feed.cancel(p)
await p // Was cancelled
feed.cancel(p)Cancel a get
await feed.has(index, [callback])Check if the feed has a specific block
await feed.download(start, end, [callback])Select a range to be downloaded.
Similarly to feed.get you can use the promise itself
to cancel a download using feed.undownload(p)
feed.undownload(p)Stop downloading a range.
await feed.update([options], [callback])Fetch an update for the feed.
Options include:
{
minLength: ..., // some min length to update to
ifAvailable: true,
hash: true
}
See the Unichain docs for more info on these options.
await feed.append(blockOrArrayOfBlocks, [callback])Append a block or array of blocks to the unichain
feed.peersA list of peers this feed is connected to.
feed.on('peer-add', peer)Emitted when a peer is added.
feed.on('peer-remove', peer)Emitted when a peer is removed.
feed.on('append')Emitted when the feed is appended to, either locally or remotely.
feed.on('download', seq, data)Emitted when a block is downloaded. data is a pseudo-buffer with {length, byteLength} but no buffer content.
feed.on('upload', seq, data)Emitted when a block is uploaded. data is a pseudo-buffer with {length, byteLength} but no buffer content.
Bitspace also includes a simple replication function for RemoteUnichains that does two things:
client.network.configure(chain, { announce: true, lookup: true }))chain.update({ ifAvailable: true }) to try to fetch the latest length from the network.This saves a bit of time when swarming a RemoteUnichain.
await replicate(chain)Quickly connect a RemoteUnichain to the BitSwarm network.
MIT
FAQs
Standalone BitSpace RPC client
We found that bitspace-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.