Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Javascript API for integration with EOSIO-based blockchains using EOSIO RPC API.
Documentation can be found here
The official distribution package can be found at npm.
yarn add eosjs
In order to get access to the TextEncoding
and TextDecoding
types, you need to add @types/text-encoding
as a dev dependency:
yarn add --dev @types/text-encoding
If you're using Node (not a browser) then you'll also need to make sure the dom
lib is referenced in your tsconfig.json
:
{
"compilerOptions": {
"lib": [..., "dom"]
}
}
Clone this repository locally then run yarn build-web
. The browser distribution will be located in dist-web
and can be directly copied into your project repository. The dist-web
folder contains minified bundles ready for production, along with source mapped versions of the library for debugging. For full browser usage examples, see the documentation.
Importing using ESM syntax is supported using TypeScript, webpack, or Node.js with --experimental-modules
flag
import { Api, JsonRpc, RpcError } from 'eosjs';
import { JsSignatureProvider } from 'eosjs/dist/eosjs-jssig'; // development only
Importing using commonJS syntax is supported by Node.js out of the box.
const { Api, JsonRpc, RpcError } = require('eosjs');
const { JsSignatureProvider } = require('eosjs/dist/eosjs-jssig'); // development only
const fetch = require('node-fetch'); // node only; not needed in browsers
const { TextEncoder, TextDecoder } = require('util'); // node only; native TextEncoder/Decoder
The Signature Provider holds private keys and is responsible for signing transactions.
Using the JsSignatureProvider in the browser is not secure and should only be used for development purposes. Use a secure vault outside of the context of the webpage to ensure security when signing transactions in production
const defaultPrivateKey = "5JtUScZK2XEp3g9gh7F8bwtPTRAkASmNrrftmx4AxDKD5K4zDnr"; // bob
const signatureProvider = new JsSignatureProvider([defaultPrivateKey]);
Open a connection to JSON-RPC, include fetch
when on Node.js.
const rpc = new JsonRpc('http://127.0.0.1:8888', { fetch });
Include textDecoder and textEncoder when using in Node. You may exclude these when running in a browser since most modern browsers now natively support these. If your browser does not support these (https://caniuse.com/#feat=textencoder), then you can import them as a dependency through the following deprecated npm package: https://www.npmjs.com/package/text-encoding
const api = new Api({ rpc, signatureProvider, textDecoder: new TextDecoder(), textEncoder: new TextEncoder() });
transact()
is used to sign and push transactions onto the blockchain with an optional configuration object parameter. This parameter can override the default value of broadcast: true
, and can be used to fill TAPOS fields given expireSeconds
and either blocksBehind
or useLastIrreversible
. Given no configuration options, transactions are expected to be unpacked with TAPOS fields (expiration
, ref_block_num
, ref_block_prefix
) and will automatically be broadcast onto the chain.
(async () => {
const result = await api.transact({
actions: [{
account: 'eosio.token',
name: 'transfer',
authorization: [{
actor: 'useraaaaaaaa',
permission: 'active',
}],
data: {
from: 'useraaaaaaaa',
to: 'useraaaaaaab',
quantity: '0.0001 SYS',
memo: '',
},
}]
}, {
blocksBehind: 3,
expireSeconds: 30,
});
console.dir(result);
})();
use RpcError
for handling RPC Errors
...
try {
const result = await api.transact({
...
} catch (e) {
console.log('\nCaught exception: ' + e);
if (e instanceof RpcError)
console.log(JSON.stringify(e.json, null, 2));
}
...
See LICENSE for copyright and license terms.
All repositories and other materials are provided subject to the terms of this IMPORTANT notice and you must familiarize yourself with its terms. The notice contains important information, limitations and restrictions relating to our software, publications, trademarks, third-party resources, and forward-looking statements. By accessing any of our repositories and other materials, you accept and agree to the terms of the notice.
FAQs
Talk to eos API
The npm package eosjs receives a total of 52,578 weekly downloads. As such, eosjs popularity was classified as popular.
We found that eosjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.