
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
cashscript
Advanced tools
CashScript is a high-level programming language for smart contracts on Bitcoin Cash. It offers a strong abstraction layer over Bitcoin Cash' native virtual machine, Bitcoin Script. Its syntax is based on Ethereum's smart contract language Solidity, but its functionality is very different since smart contracts on Bitcoin Cash differ greatly from smart contracts on Ethereum. For a detailed comparison of them, refer to the blog post Smart Contracts on Ethereum, Bitcoin and Bitcoin Cash.
See the GitHub repository and the CashScript website for full documentation and usage examples.
CashScript is a high-level language that allows you to write Bitcoin Cash smart contracts in a straightforward and familiar way. Its syntax is inspired by Ethereum's Solidity language, but its functionality is different since the underlying systems have very different fundamentals. See the language documentation for a full reference of the language.
The main way to interact with CashScript contracts and integrate them into applications is using the CashScript SDK. This SDK allows you to import .json (or .ts) artifact files that were compiled using the cashc compiler and convert them to Contract objects. These objects are used to create new contract instances. These instances are used to interact with the contracts using the functions that were implemented in the .cash file. For more information on the CashScript SDK, refer to the SDK documentation.
npm install cashscript
import { Contract, ... } from 'cashscript';
Using the CashScript SDK, you can import contract artifact files, create new instances of these contracts, and interact with these instances:
...
// Import the P2PKH artifact
import P2PKH from './p2pkh-artifact.json' with { type: 'json' };
// Instantiate a network provider for CashScript's network operations
const provider = new ElectrumNetworkProvider('mainnet');
// Create a new P2PKH contract with constructor arguments: { pkh: pkh }
const contract = new Contract(P2PKH, [pkh], { provider });
// Get contract balance & output address + balance
console.log('contract address:', contract.address);
console.log('contract balance:', await contract.getBalance());
const transactionBuilder = new TransactionBuilder({ provider });
const contractUtxos = await contract.getUtxos();
const sendAmount = 10_000n;
const destinationAddress = '... some address ...';
// Calculate the change amount, accounting for a miner fee of 1000 satoshis
const changeAmount = contractUtxos[0].satoshis - sendAmount - 1000n;
// Construct a transaction with the transaction builder
const txDetails = await transactionBuilder
// Add a contract input that spends from the contract using the 'spend' function
.addInput(contractUtxos[0], contract.unlock.spend(pk, new SignatureTemplate(keypair)))
// Add an output that sends 0. 000 100 00 BCH back to the destination address
.addOutput({ to: destinationAddress, amount: sendAmount })
// Add a change output that sends the change back to the contract's address
.addOutput({ to: contract.address, amount: changeAmount })
.send();
console.log(txDetails);
...
FAQs
Easily write and interact with Bitcoin Cash contracts
The npm package cashscript receives a total of 473 weekly downloads. As such, cashscript popularity was classified as not popular.
We found that cashscript demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.