
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
hivesigner
Advanced tools
The official HiveSigner JavaScript SDK, written in Typescript. Library supports both callback and promise functions. Learn more about integration: https://docs.hivesigner.com.
To install and run HiveSigner SDK, follow this quick start guide
HiveSigner.js was designed to work both in the browser and in Node.js.
To install HiveSigner.js on Node.js, open your terminal and run:
npm i hivesigner --save
You can create an index.html file and include HiveSigner.js with:
<script src="https://cdn.jsdelivr.net/npm/hivesigner"></script>
or
<script src="https://unpkg.com/hivesigner@latest/dist/hivesigner.min.js"></script>
For general information about HiveSigner and setting up your app you can checkout the developer documentation.
Call the Client() method when your app first loads to init the SDK:
var hivesigner = require('hivesigner');
var client = new hivesigner.Client({
app: 'demo',
callbackURL: 'https://demo.hivesigner.com',
scope: ['vote', 'comment']
});
Parameters:
This method redirects to login screen on HiveSigner website.
client.login(params);
The following method returns a URL that you can redirect the user to so that they may log in to your app through HiveSigner:
var link = client.getLoginURL(state, select_account);
// => https://hivesigner.com/oauth2/authorize?client_id=[app]&redirect_uri=[callbackURL]&scope=vote,comment&state=[state]&select_account=[select_account]
Parameters:
After logging in, HiveSigner will redirect the user to the "redirect_uri" specified in the login url above and add the following query string parameters for your app to use:
Once a user is logged in to your app you can call the following method to get the details of their account:
client.me(function (err, res) {
console.log(err, res)
});
If it is successful, the result will be a JSON object with the following properties:
{
account: { id: 43593, name: "demo", ...},
name: "demo",
scope: ["vote"],
user: "demo",
_id: "demo",
user_metadata: {profile: {name: "Demo account", ...}}
}
Decode encrypted memo, only works if encryption is done with hivesigner account's posting public key
client.decode(function (err, res) {
console.log(err, res)
});
If it is successful, the result will be a JSON object with the following properties:
{
memoDecoded: "#ev.....",
username: "demo"
}
The revokeToken() method will log the current user out of your application by revoking the access token provided to your app for that user:
client.revokeToken(function (err, res) {
console.log(err, res)
});
The vote() method will cast a vote on the specified post or comment from the current user:
client.vote(voter, author, permlink, weight, function (err, res) {
console.log(err, res)
});
Parameters:
The comment() method will post a comment on an existing post or comment from the current user:
client.comment(parentAuthor, parentPermlink, author, permlink, title, body, jsonMetadata, function (err, res) {
console.log(err, res)
});
The comment() method is rate limited to 5 minutes per root comment (post), and 20 seconds per non-root comment (reply).
The deleteComment() method will mark a comment as deleted.
client.deleteComment(author, permlink, function (err, res) {
console.log(err, res)
})
client.customJson(requiredAuths, requiredPostingAuths, id, json, function (err, res) {
console.log(err, res)
});
client.reblog(account, author, permlink, function (err, res) {
console.log(err, res)
});
client.follow(follower, following, function (err, res) {
console.log(err, res)
});
client.unfollow(unfollower, unfollowing, function (err, res) {
console.log(err, res)
});
client.ignore(follower, following, function (err, res) {
console.log(err, res)
});
client.claimRewardBalance(account, rewardHive, rewardHbd, rewardVests, function (err, res) {
console.log(err, res)
});
const op = ['transfer', {
from: '__signer',
to: 'demo123',
amount: '0.001 HIVE'
}];
hivesigner.sendOperation(op, {callback: `https://ecency.com/@${from}/wallet`}, function(err, result) {
console.log(err, result);
});
https://hivesigner.com/sign/custom-json?authority=active&required_auths=%5B%22${user}%22%5D&required_posting_auths=%5B%5D&id=someid&json=${encodeURIComponent(json)}&redirect_uri=https://ecency.com/
The result will be : https://ecency.com/?id=XXX
FAQs
Hivesigner SDK
We found that hivesigner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.