
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A comprehensive JavaScript library for blockchain and cryptographic operations, designed for enterprise-grade biometric identity systems. The SDK integrates BSV blockchain capabilities with advanced cryptographic features and secure storage solutions.
The SDK implements a flexible storage adapter that automatically switches between:
# Install core SDK and dependencies
npm install smartledger_sdk @bitcoinerlab/secp256k1 bip32 crypto-js uuid shamirs-secret-sharing
// Generate a new 24-word mnemonic
const mnemonic = SmartLedger.generateMnemonic();
// Validate mnemonic
const isValid = SmartLedger.validateMnemonic(mnemonic);
// Generate seed with optional passphrase
const seed = await SmartLedger.mnemonicToSeedHex(
mnemonic,
"optional passphrase"
);
// Derive standard paths
const paths = await SmartLedger.deriveStandardPaths(mnemonic);
// Store encrypted key with metadata
await SmartLedger.storeKey(
"key-id",
privateKey,
{
label: "My Key",
description: "Important private key",
},
"storage-encryption-key"
);
// Retrieve key
const { key, metadata } = await SmartLedger.retrieveKey(
"key-id",
"storage-encryption-key"
);
// Store mnemonic
await SmartLedger.storeMnemonic(
"mnemonic-id",
mnemonic,
{
label: "Backup Mnemonic",
},
"storage-encryption-key"
);
// Store encrypted key with metadata and custom prefix
await SmartLedger.storeKey(
"key-id",
privateKey,
{
label: "My Key",
description: "Important private key",
customData: { type: "master", version: "1.0" }
},
"storage-encryption-key"
);
// Retrieve stored key with metadata
const { key, metadata } = await SmartLedger.retrieveKey(
"key-id",
"storage-encryption-key"
);
// Remove stored key
await SmartLedger.removeKey("key-id");
// Encrypt data
const encrypted = SmartLedger.encrypt("sensitive data", "secure-key");
const decrypted = SmartLedger.decrypt(encrypted, "secure-key");
// Split secret into shares
const shares = SmartLedger.splitSecret("secret-data", 5, 3);
const reconstructed = SmartLedger.combineShares(shares.slice(0, 3));
// Split a secret using Shamir's Secret Sharing
const shares = SmartLedger.splitSecret(
"sensitive-data",
{ shares: 5, threshold: 3 }
);
// Combine shares to recover the secret
const recoveredSecret = SmartLedger.combineShares(shares.slice(0, 3));
// Generate UUIDv5
const namespace = "1b671a64-40d5-491e-99b0-da01ff1f3341";
const uuid = SmartLedger.generateUUID(namespace, "data");
// Generate key pair
const keyPair = SmartLedger.generateKeyPair();
// Sign message
const signature = SmartLedger.signMessage("message", keyPair.privateKey);
// Verify signature
const isValid = SmartLedger.verifySignature(
"message",
signature,
keyPair.publicKey
);
generateMnemonic(strength = 256): Generate mnemonicvalidateMnemonic(mnemonic): Validate mnemonic phrasemnemonicToSeed(mnemonic, passphrase): Convert mnemonic to seedmnemonicToSeedHex(mnemonic, passphrase): Convert mnemonic to seed hexderivePath(mnemonic, path, passphrase): Derive single HD wallet pathderiveStandardPaths(mnemonic, passphrase): Derive all standard pathsstoreKey(id, key, metadata, storageKey): Store encrypted keyretrieveKey(id, storageKey): Retrieve and decrypt keystoreMnemonic(id, mnemonic, metadata, storageKey): Store encrypted mnemonicretrieveMnemonic(id, storageKey): Retrieve and decrypt mnemoniclistKeys(): List all stored itemsremoveKey(id): Remove stored itemencrypt(data, key): AES encryption with CBC modedecrypt(encryptedData, key): AES decryptionhash(data, algorithm): Multiple hash algorithmssplitSecret(secret, shares, threshold): Shamir's Secret SharingcombineShares(shares): Reconstruct secretgenerateKeyPair(): Generate BSV key pairsignMessage(message, privateKey): Sign messageverifySignature(message, signature, publicKey): Verify signaturegetAddressFromNode(node): Generate BSV addressgit clone https://github.com/codenlighten/smartledger_sdk.git
cd smartledger_sdk
npm install
npm run build
npm test
Biometric Integration
Enterprise Features
Proprietary software. Licensed for use by SmartLedger partners only.
This is a private repository. Contributions are by invitation only.
FAQs
Web3Keys - Your Gateway to Blockchain | Powered by SmartLedger.Solutions
We found that web3keys demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.