Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
bch-js is a JavaScript npm library for creating web and mobile apps that can interact with the Bitcoin Cash (BCH) blockchains. It can be used for free, but requires an account on FullStack.cash for increased rate limits. Learn more from this article about Full Stack Bitcoin Cash development.
Here are two YouTube walk-through videos to help you get started:
Install library: npm install @psf/bch-js
Instantiate the library in your code:
const BCHJS = require("@psf/bch-js")
let bchjs = new BCHJS() // Defaults to BCHN network.
// testnet
bchjs = new BCHJS({ restURL: 'https://testnet3.fullstack.cash/v5/' })
This library is intended to be paired with
the bch-api REST API, and the infrastructure provided by FullStack.cash. The restURL
property can be changed to work with different Bitcoin Cash networks:
The bch-api REST API hosted by FullStack.cash uses JWT tokens to pay for increased rate limits when interacting with the back end server. See this article if you want to understand the system-as-a-whole. The JWT token can be fed to bch-js implicitly or explicitly.
BCHJSTOKEN
environment variable.apiToken
property when instantiating the library. Here is an example:const BCHJS = require("@psf/bch-js")
let bchjs = new BCHJS({
restURL: 'https://bchn.fullstack.cash/v5/',
apiToken: 'eyJhbGciO...' // Your JWT token here.
})
bch-js is included in this gatsby-ipfs-template for building uncensorable web apps that can interact with the blockchain. When building a Gatsby (or other front-end app that uses Webpack), you'll need to add these lines to your gatsby-node.js
file, as per this issue:
exports.onCreateWebpackConfig = ({ actions }) => {
actions.setWebpackConfig({
node: {
fs: 'empty'
}
})
}
This is because the new IPFS class in bch-js uses the fs library for uploading files, which is not supported by Gatsby.
We also provide minimal-slp-wallet-web as a basic Bitcoin Cash wallet with SLP support, for front end projects. bch-js is encapsulated inside the instantiation of the library Class.
ECMAScript 2017 standard JavaScript used instead of TypeScript. Works natively with node.js v10 or higher.
Full SLP tokens support: bch-js has full support for all SLP token functionality, including send, mint, and genesis transactions. It also fully support all aspects of non-fugible tokans (NFTs).
Semantic Release for continuous delivery using semantic versioning.
Greenkeeper automatic dependency management for automatically maintaining the latest, most secure dependencies.
IPFS uploads of all files and dependencies, to backup dependencies in case they are ever inaccessible from GitHub or npm.
Full documentation for this library can be found here:
bch-js uses APIDOC so that documentation and working code live in the same repository. To generate the documentation:
npm run docs
docs/index.html
file in a web browser.Have questions? Need help? Join our community support Telegram channel
Copies of this repository are also published on IPFS.
FAQs
The JavaScript library for Ergon and SLP Tokens
We found that xrg-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.