
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
**simple sync engine that feels like magic**
replicate reactive state with local first storage end-to-end encrypted via the NOSTR (web of trust)
"like git ..but for data"
Pragmatic simple state synchronization for json data using the familiar mental model of git (or blockchain). State Machine Replication (aka event sourcing or kappa) records fine grained state mutations in a log of events which are send over a shared broadcast messaging medium. Concurrent changes are linearized in a deterministic way to ensure everyone arrives at the same consistent state.
"fine grained reactivity ..but globally"
Modern front-end frameworks are arriving at the signals abstraction to organize reactive state dependencies in a way that avoids unnecessary work to re-render the ui. If eg only one json property/field gets edited replistate sends that change event over the wire and directly mutates other apps reactive ui state. The aim is to retain fine grained reactivity globally (across devices, users, app instances). Replistate uses the powerful meta programming abilities of JavaScript for an invisible API that feels like magic
import { replistate, indexedDB } from "replistate/svelte"
import { generateNsec, nostrNet } from "replistate-nostr"
const repli = replistate({
db: indexedDB(dbName),
net: nostrNet(myNsec) })
repli.addRoom({ url: nostrRelay, nsec: encryptionKey })
const state = $state( [] ) // make state reactive (svelte 5 signal)
const todos = repli(state) // make reactive state "replicatable"
// do some state mutations ...
console.log(todos.version)
console.log(todos.status)
console.log(todos.changes) // git diff
console.log(todos.diffs)
todos.sync() // git commit && git push
For more details see Demo App (Code)
or read the Tests and design considerations
MIT
FAQs
replicate reactive state with local first storage via nostr
The npm package replistate receives a total of 8 weekly downloads. As such, replistate popularity was classified as not popular.
We found that replistate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.