Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Create a tunnel:
import tunnel from 'tunnel-rat'
const t = tunnel()
Use the tunnel's In
component to send one or more elements into the tunnel:
<t.In>
<h1>Very cool!</h1>
<p>These will appear somewhere else!</p>
</t.In>
Somewhere else, use the tunnel's Out
component to render them:
<t.Out />
This example describes a simple React app that has both a HTML UI as well as a @react-three/fiber 3D scene. Each of these is rendered using separate React renderers, which traditionally makes emitting HTML from within the Canvas a bit of a pain; but thanks to tunnel-rat, this is now super easy!
import { Canvas } from '@react-three/fiber'
import tunnel from 'tunnel-rat'
/* Create a tunnel. */
const ui = tunnel()
const App = () => (
<div>
<div id="ui">
{/* Anything that goes into the tunnel, we want to render here. */}
<ui.Out />
</div>
{/* Here we're entering the part of the app that is driven by
@react-three/fiber, where all children of the <Canvas> component
are rendered by an entirely separate React renderer, which would
typically not allow the use of HTML tags. */}
<Canvas>
{/* Let's send something into the tunnel! */}
<ui.In>
<p>Hi, I'm a cube!</p>
</ui.In>
<mesh>
<boxGeometry />
<meshBasicMaterial />
</mesh>
{/* You can send multiple things through the tunnel, and
they will all show up in the order that you've defined them in! */}
<ui.In>
<p>And I'm a sphere!</p>
</ui.In>
<mesh>
<sphereGeometry />
<meshBasicMaterial />
</mesh>
</Canvas>
</div>
)
Of course, the whole thing also works the other way around:
import { Canvas } from '@react-three/fiber'
import tunnel from 'tunnel-rat'
/* Create a tunnel. */
const three = tunnel()
const App = () => (
<div>
<div id="ui">
{/* Let's beam something into the R3F Canvas! */}
<three.In>
<mesh>
<sphereGeometry />
<meshBasicMaterial />
</mesh>
</three.In>
</div>
<Canvas>
{/* Render anything sent through the tunnel! */}
<three.Out />
</Canvas>
</div>
)
0.1.2
FAQs
non gratum anus rodentum
We found that tunnel-rat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.