
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
earthweb-test
Advanced tools
EarthWeb aims to deliver a unified, seamless development experience influenced by Ethereum's Web3 implementation. We have taken the core ideas and expanded upon it to unlock the functionality of EARTH's unique feature set along with offering new tools for integrating DApps in the browser, Node.js and IoT devices.
You can access either version specifically from the dist folder.
EarthWeb is also compatible with frontend frameworks such as:
You can also ship EarthWeb in a Chrome extension.
npm install earthweb
or
yarn add earthweb
Then easiest way to use EarthWeb in a browser is to install it as above and copy the dist file to your working folder. For example:
cp node_modules/earthweb/dist/EarthWeb.js ./js/earthweb.js
so that you can call it in your HTML page as
<script src="./js/earthweb.js"><script>
Ohio is the official EARTH testnet. To use it use the following endpoint:
https://ohio.earth.engineering
Get some Ohio EARTH at https://www.earth.engineering/ohio and play with it. Anything you do should be explorable on https://explore.earth.engineering
You can set up your own private network, running Spark. To do it you must install Docker
Once you have docker installed next pull the latest Spark image from Docker Hub:
docker pull earthengineering/spark:latest
And, when ready, run a command like
docker run -it -p 9090:9090 --rm --name earth earthengineering/spark
More details about Spark on GitHub
First off, in your javascript file, define EarthWeb:
const EarthWeb = require("earthweb");
When you instantiate EarthWeb you can define
you can also set a
which works as a jolly. If you do so, though, the more precise specification has priority. Supposing you are using a server which provides everything, like EarthGrid, you can instantiate EarthWeb as:
const earthWeb = new EarthWeb({
fullHost: "https://rest.earth.engineering",
privateKey: "your private key"
});
For retro-compatibility, though, you can continue to use the old approach, where any parameter is passed separately:
const earthWeb = new EarthWeb(fullNode, solidityNode, eventServer, privateKey);
If you are, for example, using a server as full and solidity node, and another server for the events, you can set it as:
const earthWeb = new EarthWeb({
fullHost: "https://rest.earth.engineerin",
eventServer: "https://api.someotherevent.io",
privateKey: "your private key"
});
If you are using different servers for anything, you can do
const earthWeb = new EarthWeb({
fullNode: "https://some-node.tld",
solidityNode: "https://some-other-node.tld",
eventServer: "https://some-event-server.tld",
privateKey: "your private key"
});
The better way to understand how to work with Earth is to clone the MetaCoin example and follow the instructions at https://github.com/earthengineering/metacoin-box
In order to contribute you can
npm inpm run buildnpm test:nodeFAQs
Interact with a local or remote full EARTH node
We found that earthweb-test demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.