
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Tools and utilities for interacting with Project Hamilton OpenCBDC atomizer and 2pc environments
This is a pure JS node module which reads and writes the binary transaction and watchtower packet formats used in CBDC-universe0. It also contains utilities to calculate UHS and transaction hashes from output data.
The following is a breakdown of sections and classes for this cbdc-module:
Address
constructor(script_type, pubHex) - a new Address Object
getAddress() - returns {String} represented the bech32 encoding version of a publickey e.g.
decodeAddress() - returns {Object} with fields script_type (string representing) and pubHex (hex string of public key)
static decodeFromAddressString(address) - returns {Object} with fields script_type {Number} and pubHex {String} (hexdecimal string of public key)
Publickey
returns a new Publickey object
{String} a valid 32 byte hexadecimal string{String} a valid 32 byte hexadecimal stringreturns {Buffer} 32 byte buffer publickeySecretkey
returns new SecretKey with randBytes provided as random seed (if provided), otherwise it creates random key from random secrety bytes
returns {String} valid hexadecimal string of privatekeyreturns {Buffer} valid 32 byte Buffer for privatekey returns {SecretKey} from secretKeyHex
returns hexadecimal representation of privateKeybroadcast a signedTxBuf to a sentinel server at host {host} and port {port} number
returns new Input Object Type
returns Buffer representation as buffer typereturns {Buffer} Universal Hash Set hash of the input e.g. concatentation of [txid, index, witnessProgramCommitment, value] into bytes
e.g.returns {String} representing valid inputreturns signature that signed message {message} with privateKey {privateKey}
returns true or false whether the produced signature is validly signed publicKey
Note: A Universal Hash Set Hash is used to identify a specfic (UTXO) within the cbdc-universe system it is a concatenation of a txid, a 64 bit encoded index of previous tx, a witnessProgramCommitment, and a 64 bit encoded value for that encoded output
Output
returns new Output Object type
returns a Buffer representation of this output in raw bytesreturns a new {Output} from publicKey and value provided
returns {String} string representation of OutputTransaction
returns new {Transaction} object
returns {String} hexadecimal string of the unsigned raw transactionreturns {String} returns hexadecimal string of transaction id (txid)returns {Buffer} signed tx in bytesreturns {Transaction} object from the provided rawTx
BigInt is used everywhere throughout this module, that may pose problems in using toJson() methods or serializing for output
The following are example interactions.
Address
const addr = new Address('00', '3ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe9')
console.log(addr.getAddress());
usd1qqad3uq4lysjlqnzyj90fn6vcwvs05pptlw7z3g8lz7qnt2cx6a7jty6gr5
console.log(addr.decodeAddress());
{ script_type: 0, pubHex: 3ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe9 }
Publickey
const pub = new Publickey('e00b5c3d80899217a22fea87e7337907203df8a1efebd4d2a8773c8f629fff36')
console.log(pub.toBuffer());
Secretkey
const secKey = new SecretKey(Buffer.from(parseInt(Math.round(Math.random() * 10)), 'hex'));
secKey.toString();
secKey.toBuffer();
Networking
let network = require('./networking/broadcast');
const txBuf = new Transaction();
Networking.broadcast(5555, '127.0.0.1', Buffer.from(tx.toHex(), 'hex'))
Transaction
const input = new Input('9f981e64afc0fc56a0d7b355cd9eba36f3d19507088713b1f73afc5bf301a44e', 0, '70cd87ebaaa0d2d059dccaceeb7f9f823a5791d60b00aef9d9573f1fbf91ca29', 200)
const output = new Output('81b095a242974d9f4e98ca18b468b8e644e4168380a035b3d66bc279b36c6510', 200)
const tx = new Transaction([input], [output], []);
tx.sign('e00b5c3d80899217a22fea87e7337907203df8a1efebd4d2a8773c8f629fff36')
console.log(tx.getTxid());
12e01dfa90358fd203da3acbbe105b1ed2d249cd8e601ed919f4b8b2a99cbb02
console.log(tx);
01000000000000009f981e64afc0fc56a0d7b355cd9eba36f3d19507088713b1f73afc5bf301a44e000000000000000070cd87ebaaa0d2d059dccaceeb7f9f823a5791d60b00aef9d9573f1fbf91ca29c800000000000000010000000000000081b095a242974d9f4e98ca18b468b8e644e4168380a035b3d66bc279b36c6510c80000000000000001000000000000006100000000000000003ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe901986cc97272bdb7624a824afcef76936b8f945e55d6e8479b95c81298e77b42d5a255e8529fc2f0d90743e7f9997a7159b6121105c7ec9b9252da992f34611f
const secretKey = 'e00b5c3d80899217a22fea87e7337907203df8a1efebd4d2a8773c8f629fff36';
const input = new Input('9f981e64afc0fc56a0d7b355cd9eba36f3d19507088713b1f73afc5bf301a44e', 0, 70cd87ebaaa0d2d059dccaceeb7f9f823a5791d60b00aef9d9573f1fbf91ca29, 200)
const output = new Output('81b095a242974d9f4e98ca18b468b8e644e4168380a035b3d66bc279b36c6510', 200)
const tx = new Transaction([input], [output], []);
tx.sign(secretKey);
Networking.broadcast(5555, '127.0.0.1', Buffer.from(tx.toHex(), 'hex'))
const secretKey = "e00b5c3d80899217a22fea87e7337907203df8a1efebd4d2a8773c8f629fff36";
const publicKey = "3ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe9";
const sha256 = function () {...};
const message = 'onomatopoeia';
const sig = utils.sign(secretKey, message);
utils.verify(publicKey, Buffer.from(sha256(message), 'hex'), sig);
secret key: e00b5c3d80899217a22fea87e7337907203df8a1efebd4d2a8773c8f629fff36
public key: 3ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe9
01000000000000009f981e64afc0fc56a0d7b355cd9eba36f3d19507088713b1f73afc5bf301a44e000000000000000070cd87ebaaa0d2d059dccaceeb7f9f823a5791d60b00aef9d9573f1fbf91ca29c800000000000000010000000000000081b095a242974d9f4e98ca18b468b8e644e4168380a035b3d66bc279b36c6510c80000000000000001000000000000006100000000000000003ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe901986cc97272bdb7624a824afcef76936b8f945e55d6e8479b95c81298e77b42d5a255e8529fc2f0d90743e7f9997a7159b6121105c7ec9b9252da992f34611f
Tx {
inputs: [
{
tx_hash: '9f981e64afc0fc56a0d7b355cd9eba36f3d19507088713b1f73afc5bf301a44e',
index: 0n,
witness_program_commitment: '70cd87ebaaa0d2d059dccaceeb7f9f823a5791d60b00aef9d9573f1fbf91ca29',
value: 200n
}
],
outputs: [
{
witness_program_commitment: '81b095a242974d9f4e98ca18b468b8e644e4168380a035b3d66bc279b36c6510',
value: 200n
}
],
witnesses: [
{
witness_length: 97n,
script_type: 0,
pubkey: '3ad8f015f9212f8262248af4cf4cc39907d0215fdde14507f8bc09ad5836bbe9',
signature: '01986cc97272bdb7624a824afcef76936b8f945e55d6e8479b95c81298e77b42d5a255e8529fc2f0d90743e7f9997a7159b6121105c7ec9b9252da992f34611f'
}
]
}
mocha with npm install mocha or npm i -g mochanpm test from the root directoryFAQs
Tools and utilities for interacting with Project Hamilton OpenCBDC atomizer and 2pc environments
The npm package hamilton receives a total of 8 weekly downloads. As such, hamilton popularity was classified as not popular.
We found that hamilton demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.