
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
scorechain-sdk
Advanced tools
The goal of the Scorechain SDK for JavaScript is to simplify the integration of the Scorechain API into JavaScript applications. By providing a set of convenient functions and methods, developers can easily interact with the Scorechain API and access its features. This SDK aims to streamline the process of integrating Scorechain's blockchain analytics capabilities into JavaScript projects, enabling developers to leverage the power of Scorechain's technology with ease.
npm install scorechain-sdk --save
import { ScorechainConnector } from "scorechain-sdk";
const connector = new ScorechainConnector("MyScorechainApiKey");
const { ScorechainConnector } = require("scorechain-sdk")
const connector = new ScorechainConnector("MyScorechainApiKey");
All methods in the connector are wrapper for endpoints of the Scorechain API :
The ScorechainConnector includes built-in proof of authenticity checks, which validate response signatures to ensure secure communication. If you prefer to disable these checks, you can initialize the connector as follows:
const connector = new ScorechainConnector("MyScorechainApiKey", false);
In case Scorechain has to renew its private key, the recommended procedure is to update the SDK to the latest version. However, to ensure continuity, we provide a convenience function to refresh the embedded public key. This should only be used in case of emergency:
const connector = new ScorechainConnector("MyScorechainApiKey");
await connector.updateScorechainPublicKey();
Here is a simple example to send a transaction to the Transaction Monitoring System
const connector = new ScorechainConnector("MyScorechainApiKey")
const txid = "0x308b22a8e0e9e4e7d1b9fd1dfab74d7b37325b255e566f4d81edd457937c5e0c"
const address = "0x9f5A8089ecF94d3D4D7A53025d993E0cc29e2c5f"
connector.feedTransaction(txid, BlockchainEnum.ETHEREUM, ScoringDirection.INCOMING, address)
Here is a simple example of an address screening that you can call after detecting a deposit.
import { BlockchainEnum, ScorechainConnector, ScoringAnalysisType, SeverityEnum } from "scorechain-sdk";
(async () => {
const connector = new ScorechainConnector("MyScorechainApiKey")
const txid = "0x308b22a8e0e9e4e7d1b9fd1dfab74d7b37325b255e566f4d81edd457937c5e0c"
const tx = await connector.getTransaction(txid, BlockchainEnum.ETHEREUM);
const addressScore = await connector.getAddressScoringAnalysis(
tx.operations[0].destinations[0].address,
BlockchainEnum.ETHEREUM,
"MAIN",
ScoringAnalysisType.INCOMING,
6
);
const severity = Object.keys(addressScore.analysis).reduce(
(acc, analysis) => {
if (addressScore.analysis[analysis]?.result?.score === addressScore.lowestScore) {
acc = addressScore.analysis[analysis].result.severity;
}
return acc;
},
SeverityEnum.UNDEFINED_RISK
)
if (severity !== SeverityEnum.CRITICAL_RISK && severity !== SeverityEnum.HIGH_RISK) {
console.log("Transaction is safe");
} else {
console.log("Transaction is risky");
}
})()
FAQs
SDK for the Scorechain API
The npm package scorechain-sdk receives a total of 327 weekly downloads. As such, scorechain-sdk popularity was classified as not popular.
We found that scorechain-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.