Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
A Node.js module that allows you to add blockchain funds support (currently only litecoin) to your application. BlockM allows you to integrate a payment system with deposits and withdrawals for your users and even allow them make internal transactions.
Disclaimer: This is a development project, so, its very EXPERIMENTAL and currently supports only LITECOIN. Use it at your own risk.
$ npm install blockm
Pass down credentials to the module using environment variables
$ export DATA_DB='postgres://postgres:pleasechangeme@localhost:5432/blockm-db'
$ export LTC_HOST=localhost
$ export LTC_PORT=8332
$ export LTC_USER=rpcuser
$ export LTC_PASS=rpcpass
And use the module from your code.
const BlockM = require("blockm");
// Sync with Database
BlockM.sync(err => {
// Check err for errors with database connection.
});
// And when shutdown you should call the close method.
BlockM.close();
You will need a PostgreSQL database. An easy way to get one is using a docker container:
$ docker run --name blockm-db -p 5432:5432 -e POSTGRES_PASSWORD=<pleasechangeme> -d postgres
To pass creds down to the BlockM module you have several options. The easiest way is to set the DATA_DB
environment variable to an URL that specify all the PostgreSQL connection info.
Other way is just to add all the config to the lib/models/config.json
, but that is not recommended since you should not bother to edit files.
Set the database name in the url exported on the DATA_DB
environment variable:
$ cd blockm/
$ DATA_DB='postgres://postgres:<pleasechangeme>@localhost:5432/blockm-db' npm run createdb
$ DATA_DB='postgres://postgres:<pleasechangeme>@localhost:5432/blockm-db' npm run migrate
Lets run a container with litecoind
as node and configure it to allow RPC connections
docker run -v /path/to/store/blockchain/and/wallet:/home/litecoin/.litecoin --rm --name blockm-ltc -p 19332:19332 uphold/litecoind -printtoconsole -testnet -rpcallowip=172.17.0.0/16 -rpcuser=rpcuser -rpcpassword=rpcpass -server
By using this method, it will allow you to protect the wallet very well and rely on the security of the official litecoin core software, but will need to download the entire blockchain data, so this will require a lot of disk space.
Please open an Issue and propose a better solution.
$ git clone git@github.com:cronopio/blockm.git
$ cd blockm/
$ npm install
$ DATA_DB='postgres://postgres:pleasechangeme@localhost:5432/blockm-db' npm test
In general, we follow the "fork-and-pull" Git workflow.
FAQs
Litecoin accounts manager
We found that blockm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.