Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
uport-credentials
Advanced tools
DID Specification | Getting Started
Required Upgrade to uport-credentials@1.0.0 or uport@^0.6.3
^0.6.3 (uport) to support new both new uPort Mobile Clients and legacy uPort Mobile Clients - View Details
v1.0.0 (uport-credentials) to support only new uPort Mobile Clients and to use new features and fixes. In the future only v1.0.0 onwards will be supported.
:bangbang: :warning: v1.0.0 is released at the npm next tag at uport-credentials@next. While ^0.6.3 remains at uport on npm. Only the newest uPort Mobile Client release will work with v1.0.0. It will become the default release once the newest uPort Mobile Client release is widely adopted (~ 2 weeks). Reference master branch for docs and info on current default release ^0.6.3. Documentation for v1.0.0 can only be found here and in the docs folder. The developer site will not contain v1.0.0 documentation until it is the default release :warning: :bangbang:
uPort provides a set of tools for creating and managing identities that conform to the decentralized identifier (DID) specification, and for requesting and exchanging verified data between identities.
uPort Credentials simplifies the process of identity creation within JavaScript applications; additionally, it allows applications to easily sign and verify data — signed by other identities to facilitate secure communication between parties. These pieces of data take the form of signed JSON Web Tokens (JWTs), they have specific fields designed for use with uPort clients, described in the uPort specifications, collectively referred to as verifications.
To allow for maximum flexibility, uPort Credential’s only deals with creation and validation of verifications. To pass verifications between a JavaScript application and a user via the uPort mobile app, we have developed the uPort Transports library, use it in conjunction with uPort Credentials when necessary.
To hit the ground running with uPort Credentials, visit the Getting Started guide.
For details on uPort's underlying architecture, read our spec repo or check out the uPort identity contracts.
This library is part of a suite of tools maintained by the uPort Project, a ConsenSys formation. For more information on the project, visit uport.me
FAQs
Library for interacting with uport profiles and attestations
The npm package uport-credentials receives a total of 80 weekly downloads. As such, uport-credentials popularity was classified as not popular.
We found that uport-credentials demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.