
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
witnet-toolkit
Advanced tools
Basic typescript library for building Witnet Radon artifacts. This packag also bundles the `w3gw` and `witnet-toolkit` command-line tools.
This package bundles two basic tools for developers willing to build and test data requests compliant with the Witnet Oracle blockchain:
$ npm install --save-dev witnet-toolkit
const Witnet = require("witnet-toolkit")
const http_get_source_1 = Witnet.Sources.HttpGet({
url: "https://api.coinbase.com/v2/exchange-rates?currency=\\1\\",
script: Witnet.Script()
.parseJSONMap()
.getMap("data")
.getMap("rates")
.getFloat("\\0\\")
.power(-1)
.multiply(1e6).round(),
});
// ...
// ...
const WitnetRequestTemplateCoinbaseTicker = Witnet.RequestTemplate({
retrieve: [ http_get_coinbase_ticker, ],
aggregate: Witnet.Reducers.PriceAggregate(),
tally: Witnet.Reducers.PriceTally(),
});
// ...
// ...
const WitnetStaticRequestCoinbaseEthUsd6 = Witnet.StaticRequest({
retrieve: [
Witnet.Sources.HttpGet({
url: "https://api.coinbase.com/v2/exchange-rates?currency=USD",
script: Witnet.Script()
.parseJSONMap()
.getMap("data")
.getMap("rates")
.getFloat("BTC")
.power(-1)
.multiply(1e6).round(),
}),
],
aggregate: Witnet.Reducers.Median([Witnet.Filters.Stdev(1.4), ]),
tally: Witnet.Reducers.Mean(),
});
const WitnetRequestCoinbaseEthUsd6 = Witnet.RequestFromTemplate(WitnetRequestTemplateCoinbaseTicker, [ "BTC", "USD" ]),
const witnet_dr_bytecode = WitnetRequestCoinbaseEthUsd6.encode();
$ npx witnet-toolkit
USAGE:
npx witnet-toolkit <SUBCOMMAND>
FLAGS:
--help Prints help information
--verbose Prints detailed information of the subcommands being run
--version Prints version information
SUBCOMMANDS:
decode-query --hex <witnet-bytecode> Decodes some Witnet data query bytecode
trace-query --hex <witnet-bytecode> Resolves some Witnet data query bytecode locally, printing out step-by-step information
try-query --hex <witnet-bytecode> Resolves some Witnet data query bytecode locally, returning a detailed JSON report
Hex strings can be programmatically exported from scripts using the Witnet Radon typescript library.
FAQs
Basic typescript library for building Witnet Radon artifacts. This packag also bundles the `w3gw` and `witnet-toolkit` command-line tools.
We found that witnet-toolkit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.