
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
ethereum-htlc
Advanced tools
Hashed Timelock Contracts (HTLCs) for Ethereum:
Use these contracts for creating HTLCs on the Ethereum side of a cross chain atomic swap (for example the xcat project).
4447$ npm i
$ truffle test
Using network 'test'.
Compiling ./test/helper/ASEANToken.sol...
Compiling ./test/helper/EUToken.sol...
Contract: HashedTimelock
✓ newContract() should create new contract and store correct details (92ms)
✓ newContract() should fail when no ETH sent (84ms)
✓ newContract() should fail with timelocks in the past (78ms)
✓ newContract() should reject a duplicate contract request (159ms)
✓ withdraw() should send receiver funds when given the correct secret preimage (214ms)
✓ withdraw() should fail if preimage does not hash to hashX (111ms)
✓ withdraw() should fail if caller is not the receiver (162ms)
✓ withdraw() should fail after timelock expiry (1243ms)
✓ refund() should pass after timelock expiry (1273ms)
✓ refund() should fail before the timelock expiry (132ms)
✓ getContract() returns empty record when contract doesn't exist (48ms)
Contract: HashedTimelockERC20
✓ newContract() should create new contract and store correct details (214ms)
✓ newContract() should fail when no token transfer approved (107ms)
✓ newContract() should fail when token amount is 0 (166ms)
✓ newContract() should fail when tokens approved for some random account (214ms)
✓ newContract() should fail when the timelock is in the past (136ms)
✓ newContract() should reject a duplicate contract request (282ms)
✓ withdraw() should send receiver funds when given the correct secret preimage (363ms)
✓ withdraw() should fail if preimage does not hash to hashX (227ms)
✓ withdraw() should fail if caller is not the receiver (307ms)
✓ withdraw() should fail after timelock expiry (2257ms)
✓ refund() should pass after timelock expiry (2407ms)
✓ refund() should fail before the timelock expiry (283ms)
✓ getContract() returns empty record when contract doesn't exist (55ms)
Contract: HashedTimelock swap between two ERC20 tokens
✓ Step 1: Alice sets up a swap with Bob in the AliceERC20 contract (233ms)
✓ Step 2: Bob sets up a swap with Alice in the BobERC20 contract (239ms)
✓ Step 3: Alice as the initiator withdraws from the BobERC20 with the secret (97ms)
✓ Step 4: Bob as the counterparty withdraws from the AliceERC20 with the secret learned from Alice's withdrawal (144ms)
Test the refund scenario:
✓ the swap is set up with 5sec timeout on both sides (3613ms)
Contract: HashedTimelock swap between ERC721 token and ERC20 token (Delivery vs. Payment)
✓ Step 1: Alice sets up a swap with Bob to transfer the Commodity token #1 (256ms)
✓ Step 2: Bob sets up a swap with Alice in the payment contract (231ms)
✓ Step 3: Alice as the initiator withdraws from the BobERC721 with the secret (95ms)
✓ Step 4: Bob as the counterparty withdraws from the AliceERC721 with the secret learned from Alice's withdrawal (132ms)
Test the refund scenario:
✓ the swap is set up with 5sec timeout on both sides (3737ms)
Contract: HashedTimelock swap between two ERC721 tokens
✓ Step 1: Alice sets up a swap with Bob in the AliceERC721 contract (225ms)
✓ Step 2: Bob sets up a swap with Alice in the BobERC721 contract (265ms)
✓ Step 3: Alice as the initiator withdraws from the BobERC721 with the secret (131ms)
✓ Step 4: Bob as the counterparty withdraws from the AliceERC721 with the secret learned from Alice's withdrawal (119ms)
Test the refund scenario:
✓ the swap is set up with 5sec timeout on both sides (3635ms)
39 passing (27s)




newContract(receiverAddress, hashlock, timelock) create new HTLC with given receiver, hashlock and expiry; returns contractId bytes32withdraw(contractId, preimage) claim funds revealing the preimagerefund(contractId) if withdraw was not called the contract creator can get a refund by calling this some time after the time lock has expired.See test/htlc.js for examples of interacting with the contract from javascript.
newContract(receiverAddress, hashlock, timelock, tokenContract, amount) create new HTLC with given receiver, hashlock, expiry, ERC20 token contract address and amount of tokenswithdraw(contractId, preimage) claim funds revealing the preimagerefund(contractId) if withdraw was not called the contract creator can get a refund by calling this some time after the time lock has expired.See test/htlcERC20.js for examples of interacting with the contract from javascript.
newContract(receiverAddress, hashlock, timelock, tokenContract, tokenId) create new HTLC with given receiver, hashlock, expiry, ERC20 token contract address and the token to transferwithdraw(contractId, preimage) claim funds revealing the preimagerefund(contractId) if withdraw was not called the contract creator can get a refund by calling this some time after the time lock has expired.FAQs
Hashed Timelock Contracts for Ethereum
The npm package ethereum-htlc receives a total of 6 weekly downloads. As such, ethereum-htlc popularity was classified as not popular.
We found that ethereum-htlc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.

Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.