Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
ethereumjs-vm
Advanced tools
Implements Ethereum's VM in Javascript.
The VM currently supports the following hardfork rules:
Byzantium
Constantinople
Petersburg
(default)Istanbul
MuirGlacier
(only mainnet
and ropsten
)If you are still looking for a Spurious Dragon compatible version of this library install the latest of the 2.2.x
series (see Changelog).
An Ethereum test suite compliant MuirGlacier
HF implementation is available
since the v4.1.3
VM release. You can activate a MuirGlacier
VM by using the
muirGlacier
hardfork
option flag.
Note: The original v4.1.2
release contains a critical bug preventing the
MuirGlacier
VM to work properly and there is the need to update.
An Ethereum test suite compliant Istanbul
HF implementation is available
since the v4.1.1
VM release. You can activate an Istanbul
VM by using the
istanbul
hardfork
option flag.
Supported Istanbul
EIPs:
F
precompile,
PR #584alt_bn128
precompile gas costs,v4.0.0
)npm install ethereumjs-vm
const BN = require('bn.js')
var VM = require('ethereumjs-vm').default
// Create a new VM instance
// For explicity setting the HF use e.g. `new VM({ hardfork: 'petersburg' })`
const vm = new VM()
const STOP = '00'
const ADD = '01'
const PUSH1 = '60'
// Note that numbers added are hex values, so '20' would be '32' as decimal e.g.
const code = [PUSH1, '03', PUSH1, '05', ADD, STOP]
vm.on('step', function(data) {
console.log(`Opcode: ${data.opcode.name}\tStack: ${data.stack}`)
})
vm.runCode({
code: Buffer.from(code.join(''), 'hex'),
gasLimit: new BN(0xffff),
})
.then(results => {
console.log('Returned : ' + results.returnValue.toString('hex'))
console.log('gasUsed : ' + results.gasUsed.toString())
})
.catch(err => console.log('Error : ' + err))
This projects contain the following examples:
All of the examples have their own README.md
explaining how to run them.
To build the VM for standalone use in the browser, see: Running the VM in a browser.
For documentation on VM
instantiation, exposed API and emitted events
see generated API docs.
The API for the StateManager
is currently in Beta
, separate documentation can be found here, see also release notes from the v2.5.0
VM release for details on the StateManager
rewrite.
The VM processes state changes at many levels.
The opFns for CREATE
, CALL
, and CALLCODE
call back up to runCall
.
You can subscribe to the following events of the VM:
beforeBlock
: Emits a Block
right before running it.afterBlock
: Emits RunBlockResult
right after running a block.beforeTx
: Emits a Transaction
right before running it.afterTx
: Emits a RunTxResult
right after running a transaction.beforeMessage
: Emits a Message
right after running it.afterMessage
: Emits an EVMResult
right after running a message.step
: Emits an InterpreterStep
right before running an EVM step.newContract
: Emits a NewContractEvent
right before creating a contract. This event contains the deployment code, not the deployed code, as the creation message may not return such a code.You can perform asynchronous operations from within an event handler and prevent the VM to keep running until they finish.
In order to do that, your event handler has to accept two arguments. The first one will be the event object, and the second one a function. The VM won't continue until you call this function.
If an exception is passed to that function, or thrown from within the handler or a function called by it, the exception will bubble into the VM and interrupt it, possibly corrupting its state. It's strongly recommended not to do that.
If you want to perform synchronous operations, you don't need to receive a function as the handler's second argument, nor call it.
Note that if your event handler receives multiple arguments, the second one will be the continuation function, and it must be called.
If an exception is thrown from withing the handler or a function called by it, the exception will bubble into the VM and interrupt it, possibly corrupting its state. It's strongly recommended not to throw from withing event handlers.
Developer documentation - currently mainly with information on testing and debugging - can be found here.
See our organizational documentation for an introduction to EthereumJS
as well as information on current standards and best practices.
If you want to join for work or do improvements on the libraries have a look at our contribution guidelines.
FAQs
An Ethereum VM implementation
We found that ethereumjs-vm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.