Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
xdcnetwork-mobilesdk
Advanced tools
The XDC Mobile SDK is a key component of the XDC Wallet Protocol that allows developers to retake control of the user experience by eliminating the reliance for end-users to complete complex blockchain operations through third party apps. By utilizing the SDK, developers gain access to the necessary tools that enable them to create familiar and native mobile UX while leveraging the benefits of blockchain technology.
The XDC Mobile SDK makes it easy to create web3 mobile apps by: Simplifying self-custody: Create performative EOAs (Externally Owned Accounts) under the hood, stored on the user's device, and secured by native OS technology.
Install with npm
npm install xdcnetwork-mobilesdk
Install required dependencies:
npm install --save react-native-keychain
npm install --save react-native-get-random-values
//for IOS
npx pod-install
Generate an EOA on-device at device + application level.
import { createAccount } from 'xdcnetwork-mobilesdk';
const newAccount = await createAccount();
Get the public address of the EOA generated by the SDK.
import { getAccount } from 'xdcnetwork-mobilesdk';
const account = await getAccount();
Display the seed phrase to users to enable users to import their crypto account an external wallet app.
import { getAccountPhrase } from 'xdcnetwork-mobilesdk';
const mnemonic = await getAccountPhrase();
The account generation process uses the BIP39 mnemonic generation to create a hierarchical-deterministic (HD) wallet. This mnemonic is used to extract a private key from the BIP32 path "m/44'/60'/0'/0/0" which is the Ethereum default path.
The above approach bypasses the performance issues that occur when performing big int math in javascript within a React Native app. The generated ethers js wallet does not have access to the mnemonic, it is not able to create a second wallet with a different path.
Private keys are generated at the app + device level, and if the user uninstalls and reinstalls the application on the same device, the same private key will be used. However, if the user reinstalls the app on a different device, a new private key will be generated.
Developers who opt in to utilize iOS or Google's cloud recovery will generate a private key at the device + cloud account level. Users are able to utilize the same crypto account on multiple devices as long as they are logged into their cloud account on their device.
Private key storage makes use of hardware encryption and low level OS key storage technology on device.
FAQs
test
The npm package xdcnetwork-mobilesdk receives a total of 0 weekly downloads. As such, xdcnetwork-mobilesdk popularity was classified as not popular.
We found that xdcnetwork-mobilesdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.