
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ErasureJS module comprises of:
const {ErasureClient,ErasureGraph,ErasureFeed,ErasurePost,ErasureAgreement,ErasureEscrow,ErasureUtils} = require("erasurejs)
wallet : Implemented using ethers.js wallet module, which can be converted from JSON key file, private ket, mnemonic, or web3 wallet.
provider: Implemented using ethers.js module, which can be converted from web3Provideripfs : Default = infura node, format : {host:"",port:"",protocol:"https"} network (optional) : only used in development envgraph : default to ErasureGraph of provider's network, can passed in custom local graph for developmentconst {VERSION_V1,VERSION_V2,MAINNET,RINKEBY} = ErasureUtils
const client = new ErasureClient({version=VERSION_V2})
const graph = new ErasureGraph({version=VERSION_V1,network=MAINNET})
const client = new ErasureClient({wallet=null, provider=null, ipfs=null:{host:string,post:string,protocol:string},graph=null:string})
await client.createUser() -> ErasureUserawait client.createFeed() -> ErasureFeedawait client.getFeed(address) -> ErasureFeedawait client.getPost({proofHash,feedAddress}) -> ErasurePostawait client.createAgreement() -> ErasureAgreementawait client.getAgreement(address) ->ErasureAgreementawait client.createEscrow() -> ErasureEscrowawait client.getEscrow(address) -> ErasureEscrowawait client.getAllUsers()await client.getUsersCount()await client.getPaginatedUsers(start,end)await client.getUserData(address)await client.getAllFeeds()await client.getFeedsCount()await client.getPaginatedFeeds(start,end)await client.getAllAgreements()await client.getAgreementsCount()await client.getPaginatedAgreements(start,end)await client.getAllEscrows()await client.getEscrowsCount()await client.getPaginatedEscrows(start,end)const erasureUser = new ErasureUser({wallet,provider,ipfs,graph})
const [keypair,confirmedTx] = await erasureUser.createAndRegisterUser({msg,salt=null})
+ How it works:
1. Create new asym keypair
2. Upload pubkey to Erasure_User registry
3. @return keypair
await erasureUser.removeUser()
await client.getUserData(address)
await owner()await setMetadata(data)await denounceOperator()await transferOperator(address)await operator()address - instance's addresscontract - Contract objectconst feed = new ErasureFeed({address,wallet,provider,ipfs,graph})
await feed.createPost(rawData)
+ How It works:
1. Create symkey
2. Encrypt rawData with symkey
3. Create metadata object:
{
address: this.wallet.address,
rawDataIpfsHash
symkeyIpfsHash
encryptedIpfsHash
}
4. Upload metadata's multihash digest form to feeds as proofhash
5. Upload metadata and encryptedData to IPFS
await feed.reveal() : Reveal all postsawait feed.getAllEscrows() : Get all Escrowsawait feed.offerBuy() : Create escrow for this feed as buyerawait feed.offerSell() : Create escrow for this feed as sellerawait feed.offerAsOperator() : create esrow for this feed as operatorawait feed.status()const post = new ErasurePost({feedAddress,proofHash})
const success:bool = await post.reveal({symKey})
+ How it works:
1. Get the latest post(== proofHash == ipfs path of metadata) of feed from graph
2. Get metadata from ipfs path
3. Validate symkey and rawData
4. Upload symkey and rawData to IPFS
await post.offerSell(): Create escrow as sellerawait post.offerBuy() : Create escrow as buyerawait post.offerAsOperator() : Create escrow as operatorawait post.status() : Get status if revealedawait post.owner()await post.proofHash()await post.getEscrows() : Get all Escrows that transact this postconst escrow = new ErasureEscrow({address,wallet,provider,ipfs,graph})
await escrow.depositPayment(amount)await escrow.cancel()await escrow.timeout()await escrow.retrieveDataFromSeller()
await escrow.depositStake(amount)await escrow.finalize()await escrow.cancel()await escrow.deliverKey({symKey)
await escrow.getAgreement() : Get ErasureAgreement obj of this escrowawait escrow.buyer()await escrow.owner()await escrow.seller()await escrow.status()await escrow.data()const agreement = new ErasureAgreement({address,wallet,provider,ipfs,graph})
await agreement.reward(amount)await agreement.punish(amount)await agreement.releaseStake()await agreement.timeout()await agreement.cancel()await agreement.retrieveStake() (countdown)await agreement.staker()await agreement.counterparty()await agreement.owner()await agreement.status()await escrow.data()const {ErasureGraph} = require("erasureJs")
const erasureGraph = new ErasureGraph({network:ErasureUtils.RINKEBY,version:ErasureUtils.VERSION_V2})
mainnet or rinkery for accessing Erasure graph public nodeganache for local node (require having a graph node locally and run deploy graph)events array is passed in, client will listen to all eventserasureGraph.startListening(events=null,cb)
erasrureGraph.query(queryName=null,eventName,opts:Obj,returnData:String)
COMING SOON : Details of all queries available
yarnyarn ganacheyarn testFAQs
Erasure JS , wraping contract ABIs
We found that erasurejs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.