
Research
Security News
Malicious npm Packages Target BSC and Ethereum to Drain Crypto Wallets
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
npm i btcpay
$ node -p "require('btcpay').crypto.generate_keypair().getPrivate('hex')"
XXXXXXXXXXXXXXXXXXXXX
Store the printed value in a safe place, e.g. environment variables
After generating your private key, you have to pair your client with your BTCPay store:
# Replace the BTCPAY_XXX envirnoment variables with your values and run:
$ [space] BTCPAY_URL=https://mydomain.com/ BTCPAY_KEY=... BTCPAY_PAIRCODE=... node -e "const btcpay=require('btcpay'); new btcpay.BTCPayClient(process.env.BTCPAY_URL, btcpay.crypto.load_keypair(Buffer.from(process.env.BTCPAY_KEY, 'hex'))).pair_client(process.env.BTCPAY_PAIRCODE).then(console.log).catch(console.error)"
# (prepend the line with a space to prevent BTCPAY_KEY from being saved to your bash history)
>>> { merchant: 'XXXXXX' }
Store the value of "merchant" in a safe place, e.g. environment variables
After pairing your client to the store, you can recreate the client as needed and use it in your code
const btcpay = require('btcpay')
const keypair = btcpay.crypto.load_keypair(new Buffer.from(<PRIVATEKEY>, 'hex'))
// Recreate client
const client = new btcpay.BTCPayClient(<BTCPAYURL>, keypair, {merchant: <MERCHANT>})
Fetches current rates from BitcoinAverage (using your BTCPayServer)
client.get_rates(['BTC_USD'], <STOREID>)
.then(rates => console.log(rates))
.catch(err => console.log(err))
The first argument accepts a comma-separated list of currency pair.
See BitPay Invoice API documentation
client.create_invoice({price: 20, currency: 'USD'})
.then(invoice => console.log(invoice.url))
.catch(err => console.log(err))
client.get_invoice(<invoice-id>)
.then(invoice => console.log(invoice.status))
.catch(err => console.log(err))
FAQs
A nodejs client implementation for BTCPay
The npm package btcpay receives a total of 90 weekly downloads. As such, btcpay popularity was classified as not popular.
We found that btcpay demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
Security News
TC39 advances 9 JavaScript proposals, including Array.fromAsync, Error.isError, and Explicit Resource Management, which are now headed into the ECMAScript spec.
Security News
Vite releases Rolldown-Vite, a Rust-based bundler preview offering faster builds and lower memory usage as a drop-in replacement for Vite.