
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
solidity-shell
Advanced tools
[](https://diligence.consensys.net) <sup> [[ 🌐 ](https://diligence.consensys.net
An interactive Solidity shell with lightweight session recording and remote compiler support.
💾 npm install -g solidity-shell
note: requires npm install -g ganache-cli unless it is already installed :)
⇒ solidity-shell
🚀 Entering interactive Solidity shell. '.help' and '.exit' are your friends.
» ℹ️ ganache-mgr: starting temp. ganache instance ...
»
» uint a = 100
» uint b = 200
» a + b + 2 + uint8(50)
352
» $_
352
Oh, did you know that we automatically fetch a matching remote compiler when you change the solidity pragma? It is as easy as typing pragma solidity 0.5.0 and solidity-shell will do the rest 🙌.
pragma solidity <version> attempts to dynamically load the selected compiler version (remote compiler, may take a couple of seconds).{ <statement>; } to ignore a calls return value..session command. Your previous session is always stored and can be loaded via .session load previous (not safe when running concurrent shells)..reset completely removes all statements. .undo removes the last statement..dump.config set <key> <value> to change settings like ganache port, ganache autostart, etc.$_ is a placeholder for the last known result. Feel free to use that placeholder in your scripts :)import "<path>" assumes that path is relative to the current working-dir (CWD) or {CWD}/node_modules/. There's experimental support for HTTPs URL's. You can disable https resolving by setting » .config set resolveHttpImports false. » import "https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/master/contracts/token/ERC721/IERC721.sol"
Any arguments provided after an empty -- are directly passed to ganacheCmd (default: ganache-cli). This way, for example, you can start a solidity shell on a ganache fork of mainnet via infura. Check ganache-cli --help for a list of available options.
⇒ solidity-shell -- --fork https://mainnet.infura.io/v3/yourApiToken
🚀 Entering interactive Solidity shell. Type '.help' for help, '.exit' to exit.
» ℹ️ ganache-mgr: starting temp. ganache instance ...
»
» interface ERC20 {
multi> function name() external view returns (string memory);
multi> }
» ERC20(0xB8c77482e45F1F44dE1745F52C74426C631bDD52).name()
BNB
🚀 Entering interactive Solidity ^0.8.11 shell. '.help' and '.exit' are your friends.
» ℹ️ ganache-mgr: starting temp. ganache instance ...
»
» .help
📚 Help:
-----
$_ is a placeholder holding the most recent evaluation result.
pragma solidity <version> to change the compiler version.
General:
.help ... this help :)
.exit ... exit the shell
.restartblockchain ... restart the ganache blockchain service
Settings:
.config ... show settings
set <key> <value> ... set setting
unset <key> ... unset setting
Session:
.session ... list sessions
load <id> ... load session
save <id> ... save session
.undo ... undo last command
.reset ... reset cmd history. start from scratch.
Debug:
.proc ... show processes managed by solidity-shell (ganache)
.dump ... show template contract
.echo ... every shell needs an echo command
cheers 🙌
@tintinweb
ConsenSys Diligence @ https://consensys.net/diligence/
https://github.com/tintinweb/solidity-shell/

msg.sender etc. » msg.sender
0x70e9B09abd6A13D2F5083CD5814076b77427199F
» address(uint160(address(msg.sender)))
0x70e9B09abd6A13D2F5083CD5814076b77427199F
⇒ solidity-shell
🚀 Entering interactive Solidity shell. Type '.help' for help, '.exit' to exit.
» ℹ️ ganache-mgr: starting temp. ganache instance ...
»
» contract TestContract {}
» new TestContract()
0xFBC1B2e79D816E36a1E1e923dd6c6fad463F4368
» msg.sender
0x363830C6aee2F0c43922bcB785C570a7cca613b5
» block.timestamp
1630339581
» struct yolo {uint8 x; uint8 y;}
» function mytest(uint x) public pure returns(uint) {
multi> return x -5;
multi> }
» mytest(100)
95

» struct yolo {uint8 x; uint8 y;}
» .dump
// SPDX-License-Identifier: GPL-2.0-or-later
pragma solidity ^0.8.7;
contract TestContract {}
struct yolo {uint8 x; uint8 y;}
contract MainContract {
function main() public {
uint a = 100;
uint b = 200;
a + b + 2 + uint8(50);
new TestContract();
msg.sender;
block.timestamp;
return ;
}
}
FAQs
An interactive Solidity shell with lightweight session recording and remote compiler support
We found that solidity-shell demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.