
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
[](https://dev.azure.com/dwrdev/Torchwood/_build/latest?definitionId=114)
An ethereum library for watching contract changes on the chain.
npm i
npm build
to build the project (creates release folder with js files & maps)npm run package
same as npm build, but also creates a package.json
file for release and a package.zip
npm test
to run all testsYou can use Torchwood to create your own oracle. For this you need:
ganache-cli
Torchwood uses the default solcjs settings when compiling, this is equivalent of running solc --optimize
which should compile and optimize the contract for 200 runs. If you compiled and deployed the contract using Truffle or another testing framework, make sure that it is compiling the contracts with the optimizer enabled.
By default Truffle does not have the optimizer enabled when compiled contracts. To enable the optimizer you must open your truffle.js
or truffle-config.js
file and adjust your module.exports
object to look like the following:
module.exports = {
solc: {
optimizer: {
enabled: true, // Enable solc optimizer
},
}
};
Follow the README of this sample oracle project that uses Torchwood: https://github.com/liliankasem/torchwood-oracle
FAQs
[](https://dev.azure.com/dwrdev/Torchwood/_build/latest?definitionId=114)
The npm package torchwood receives a total of 1 weekly downloads. As such, torchwood popularity was classified as not popular.
We found that torchwood demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.