
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
rippled-ws-client-sign
Advanced tools
Sign transactions locally to submit with rippled-ws-client
rippled-ws-client
This is a ES6 module to complement rippled-ws-client. This module allows you to:
tx_blob
and tx_id
(useful for air gapped transactions) 😎tx_blob
and tx_id
)Sequence
, the LastLedgerSequence
and/or the Fee
: if you don't enter them the class will find the right values for you.tx_blob
or by signing one) returns a promise. The class will handle watching the ledger for you, so the promise will either resolve because the transaction is in a validated ledger, of reject because there of an error or the Leder Index is past the entered / auto generated LastLedgerSequence.To use this module in vanillajs, vue-webpack, nodejs, etc.: please check the docs for rippled-ws-client: same thing for rippled-ws-client-sign.
const RippledWsClient = require('rippled-ws-client')
const RippledWsClientSign = require('rippled-ws-client-sign')
let Seed = 'sXXXXXXXXXXXXX' // (Keypair and MultiSig supported as well!)
const Transaction = {
TransactionType: 'Payment',
Account: 'rXXXXXXXXX..',
Destination: 'rYYYYYYYYY..',
DestinationTag: 1337,
Amount: 0.25 * 1000000, // Amount in drops, so multiply (6 decimal positions)
LastLedgerSequence: null // Null = auto detect, last + 5
}
new RippledWsClient('wss://s1.ripple.com').then((Connection) => {
new RippledWsClientSign(Transaction, Seed, Connection).then((TransactionSuccess) => {
console.log('TransactionSuccess', TransactionSuccess)
Connection.close()
}).catch((SignError) => {
console.log('SignError', SignError.details) // .details ;)
Connection.close()
})
}).catch((ConnectionError) => {
console.log('ConnectionError', ConnectionError)
})
In the sample (above) a family seed is entered (as the second RippledWsClientSign
argument). It is also possible to supply a keypair; eg.:
{
publicKey: "XXXX",
privateKey: "XXXX"
}
This lib. supports MultiSig (Multi-Signing) as well; you can sign a MultiSig transaction by providing an array with either multiple keypairs or multiple family seeds. They can be used in mixed mode. Here's a sample.
If you want to set an alternate signAs
value you can specify the account
or signAs
value in the objects in the array with the MultiSig keypairs/seeds. Sample:
let MultiSigKeypairs = [
'shwxKJsHuTct5EcqcLRAx7o7mPMxn',
{
privateKey: '00018FFAF1911AC7C1D52833D2DD20CC36AD727C37AB7298D652BA7A1F48786C63',
signAs: 'rsAW8cc8EXkmogYse6zz3Z9NU2QEep5q3p'
},
{
familySeed: 'ssPpqpaqWkq7F7yDnS5aY16S7Qu1V'
}
]
When the fee is not specified in the transaction (causing the lib. to auto-detect the fee) the fee will be multiplied by the amount of signers as per the Ripple documentation.
When using this code in online mode, the source will check for a valid RippledWsClient
object using:
RippledWsClient.constructor.name === 'RippledWsClient'
The default compress / mangle configuration of the UglifyJs plugin will break this. To prevent this, modify build/webpack.prod.conf.js
and configure the UglifyJsPlugin
with the keep_fnames
and keep_classnames
like this:
uglifyOptions: {
compress: {
warnings: false,
keep_fnames: true,
keep_classnames: true
},
mangle: {
keep_fnames: true,
keep_classnames: true
}
},
This class rejects a RippledWsClientSignError
-error. This error is identical to Error
, but adds the .details
property. In .details
additional information about the Error is available (e.g. the response from the rippled-server).
.details.type
) exist:invalid_wsclient
subscribe_error
account_info_invalid
account_info_error
seed_invalid
keypair_invalid_keys
keypair_invalid_hex
keypair_invalid
transaction_invalid
transaction_invalid_no_signed_object
invalid_transaction_json
invalid_transaction_type
invalid_transaction_jsonstring
sequence_required_offline
fee_required_offline
sequence_not_a_number
transaction_error
transaction_submit_error
transaction_submit_non_tes_or_queued
sign_error
This module will ALWAYS sign locally / client-side.
Your seed / secret / Private Key will NEVER be sent accross the WebSocket / internet 🎉
FAQs
Sign transactions locally to submit with rippled-ws-client
We found that rippled-ws-client-sign demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.