
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
gridplus-sdk
Advanced tools
WARNING: This is early alpha software and is subject to change. It is recommended that any mainnet usage be restricted to small amounts.
The Grid+ SDK allows any application to establish a connection and interact with a Grid+ Lattice1 device as a remote signer. With the Lattice1 as an extremely secure, connected keystore with signing capabilities, this SDK gives users the following functionality:
The documentation for this SDK can be found here. There you will find a complete quickstart guide (a shorter version of which is available in the next section) as well as a full API reference and schema enumerations. Please consider that document the source of truth for all things SDK.
This SDK is currently only available as a node.js
module. You can add it to your project with:
npm install gridplus-sdk
You can then import a new client with:
import { Client } from 'gridplus-sdk';
or, for older style syntax:
const Sdk = require('gridplus-sdk').Client;
Once imported, you can instantiate your SDK client with a clientConfig
object, which at minimum requires the name of your app (name
) and a private key with which to sign requests (privKey
). The latter is not meant to e.g. hold onto any cryptocurrencies; it is simply a way of maintaining a secure communication channel between the device and your application.
const crypto = require('crypto');
const clientConfig = {
name: 'MyApp',
crypto: crypto,
privKey: crypto.randomBytes(32).toString('hex')
}
To connect the SDK to supported cryptocurrency networks, you will need to add providers to the clientConfig
. We have two from which to choose:
import { providers } from `gridplus-sdk`;
const eth = new providers.Ethereum({
network: 'rinkeby'
etherscan: true,
});
const btc = new providers.Bitcoin({
network: 'test3',
blockcypher: true,
coin: 'btc',
});
clientConfig.providers = [ eth, btc ];
With the clientConfig
filled out, you can instantiate a new SDK client object:
const client = new Client(clientConfig);
You can run the tests in this repo, but you need to ensure you have proper configuration. You should create a file called secrets.json
in the root of this repo, which should be of the following form:
{
"ethHolder": {
"address": <ETH address>,
"privKey": <32 byte hex string>
},
"btcHolder": {
"address": <BTC recipient regtest address>,
"wif": <BTC recipient regtest wif>,
"regtestAddress": <BTC sender regtest address>,
"regtestWif": <BTC sender regtest wif>,
"bcyAddress": <BTC sender blockcypher testnet address>,
"bcyWif": <BTC sender blockcypher testnet address>
},
"etherscanApiKey": <key>,
"blockcypherApiKey": <key>,
"baseUrl": <URL of host>,
"ethNode": {
"host": "localhost",
"port": 7545
},
"btcNode": {
"host": "localhost",
"port": 48332,
"network": "regtest"
}
}
Note that only baseUrl
is needed to run basic tests with:
npm run test:lattice
which should be enough to validate all of the signing endpoints. The other fields are needed for currency-specific tests.
Testing with Ethereum
You can test with a local Ethereum provider such as Ganache by utilizing the ethNode
and ethHolder
objects in your secrets.json
file and running
npm run test:local-eth
You can also run a test on the Rinkeby test network using the etherscanApiKey
param (i.e. your API key for Etherscan) and running:
npm run test:rinkeby
Testing with Bitcoin
To run Bitcoin-based tests, you should have a local bcoin client running, preferably in regtest
mode, and run:
npm run test:local-btc
You can also run a test using the Blockcypher testnet (BCY), which runs much faster than testnet3. You will need to utilize the blockcypherApiKey
param in secrets.json
and run:
npm run test:bcy
We welcome UX-related pull requests and any feedback from Lattice1 developers. To learn more about the Lattice1, please visit our website.
FAQs
SDK to interact with GridPlus Lattice1 device
We found that gridplus-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.