
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
catenis-api-emulator
Advanced tools
Catenis API emulator meant to be used for testing Catenis API clients.
This Node.js application is meant to be used for testing Catenis API clients.
The application can be installed globally or under the project of the Catenis API client being tested.
To install it globally:
npm install -g catenis-api-client
To install it under the Catenis API client's project:
npm install --save-dev catenis-api-client
When the application is run, two HTTP servers are started at the localhost
address:
For a list of the available command line options:
catenis-api-client --help
Method: POST
Path: /device-credentials
Body:
({
deviceId: string,
apiAccessSecret: string
} | [
{
deviceId: string,
apiAccessSecret: string
}
])
{
"deviceId": "drc3XdxNtzoucpw9xiRp",
"apiAccessSecret": "4c1749c8e86f65e0a73e5fb19f2aa9e74a716bc22d7956bf3072b4bc3fbfe2a0d138ad0d4bcfee251e4e5f54d6e92b8fd4eb36958a7aeaeeb51e8d2fcc4552c3"
}
[
{
"deviceId": "drc3XdxNtzoucpw9xiRp",
"apiAccessSecret": "4c1749c8e86f65e0a73e5fb19f2aa9e74a716bc22d7956bf3072b4bc3fbfe2a0d138ad0d4bcfee251e4e5f54d6e92b8fd4eb36958a7aeaeeb51e8d2fcc4552c3"
},
{
"deviceId": "d8YpQ7jgPBJEkBrnvp58",
"apiAccessSecret": "267a687115b9752f2eec5be849b570b29133528f928868d811bad5e48e97a1d62d432bab44803586b2ac35002ec6f0eeaa98bec79b64f2f69b9cb0935b4df2c4"
}
]
Method: GET
Path: /device-credentials
Method: POST
Path: /http-context
Body:
{
expectedRequest: {
httpMethod: ('GET' | 'POST'),
apiMethodPath: string,
headers?: Object<string, (string | null)>,
data?: string, /* JSON */
authenticate: boolean
},
requiredResponse?: ({
data: string /* JSON */
} | {
statusCode: Number,
errorMessage?: String
})
}
{
"expectedRequest": {
"httpMethod": "POST",
"apiMethodPath": "messages/log",
"data": "{\"message\":\"Test message #1\"}",
"authenticate": true
},
"requiredResponse": {
"data": "{\"messageId\":\"mdx8vuCGWdb2TFeWFZd6\"}"
}
}
{
"expectedRequest": {
"httpMethod": "POST",
"apiMethodPath": "messages/log",
"data": "{\"message\":\"This is another test message\"}",
"authenticate": true
},
"requiredResponse": {
"statusCode": 400,
"errorMessage": "Not enough credits to pay for log message service"
}
}
{
"expectedRequest": {
"httpMethod": "POST",
"apiMethodPath": "messages/log",
"headers": {
"Content-Encoding": "deflate"
},
"data": "{\"message\":\"This is a long message, long enough to make sure that it will be compressed before being sent. If it is not long enough, the message will not be compressed.\"}",
"authenticate": true
},
"requiredResponse": {
"data": "{\"messageId\":\"mBQjBLCATBrRxST3Gu4F\"}"
}
}
Method: GET
Path: /http-context
Method: POST
Path: /notify-context
Body:
Object<string, Object<string, {
data: string, /* JSON */
timeout?: number
}>>
Where the key
of the outer dictionary is a Catenis virtual device ID, and the key
of the inner dictionary is a
Catenis notification event.
{
"drc3XdxNtzoucpw9xiRp": {
"new-msg-received": {
"data": "{\"messageId\":\"mNEWqgSMAeDAmBAkBDWr\",\"from\":{\"deviceId\":\"dnN3Ea43bhMTHtTvpytS\",\"name\":\"deviceB\",\"prodUniqueId\":\"XYZABC001\"},\"receivedDate\":\"2018-01-29T23:27:39.657Z\"}",
"timeout": 5
}
}
}
Method: GET
Path: /notify-context
Method: POST
Path: /notify-close
Body: none
Method: GET
Path: /info
Method: POST
Path: /close
Body: none
This application is released under the MIT License. Feel free to fork, and modify!
Copyright © 2023, Blockchain of Things Inc.
FAQs
Catenis API emulator meant to be used for testing Catenis API clients.
The npm package catenis-api-emulator receives a total of 0 weekly downloads. As such, catenis-api-emulator popularity was classified as not popular.
We found that catenis-api-emulator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.