
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
IMPORTANT NOTE: Oreppo does NOT collect actual HTTP bodies and headers, only parameter names.
Oreppo is an OpenTelemetry-based SDK for privacy scanning and monitoring in Node.js applications. It automatically instruments your application to collect HTTP and database traces while respecting privacy concerns.
npm install oreppo
or
yarn add oreppo
import { Oreppo } from 'oreppo';
// Initialize the SDK
const oreppo = new Oreppo({
apiKey: 'your-api-key',
applicationId: 'your-app-id',
});
// Start the SDK
await oreppo.start();
// Your application code here...
// Shutdown when your app terminates
await oreppo.shutdown();
The SDK accepts the following configuration options:
Option | Type | Required | Default | Description |
---|---|---|---|---|
apiKey | string | Yes | - | Your Oreppo API key |
applicationId | string | Yes | - | Unique identifier for your application from Oreppo |
flushMs | number | No | 60000 | Interval (in ms) to flush traces to backend |
debug | boolean | No | false | Enable debug logging |
The SDK is designed with privacy in mind:
The SDK automatically instruments:
It's important to properly shutdown the SDK when your application terminates:
process.on('SIGTERM', async () => {
await oreppo.shutdown();
process.exit(0);
});
To build the package locally, run:
npm run build
For support, please contact support@oreppo.com or open an issue on our GitHub repository.
FAQs
Oreppo's OpenTelemetry SDK for privacy scanning.
We found that oreppo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.