
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
currency.converter package fetches currency rate data from European Central Bank for about recent 3 months. Once the data is fetched, the data is persisted in ZODB in case of whatever difficulty to fetch the data again. There are currency converter page and portlet included in this package and several methods you can use for your own applications.
Log in as a manager and go to the page, "your_portal/@@manage-currency". By visiting the page, the current currency data will be fetched if possible and automatically persisted.
Site manager can give two different variables in addition to currencies, days and margin.
Days This amout is used to caclulate average of currencies. For example, if you input 10 to this field, 10 recent days are used to calculate average currency rate. This keeps currency rate fluctuation smaller than using everyday plain rate. If nothing or 0 is input there, it doesn't calculate average, but uses current rate.
Margin Margin adds % of rate to the currency rate. 0 is 0 % margin where is no margin.
If you are using zc.buildout and the plone.recipe.zope2instance recipe to manage your project, just do this:
Add currency.converter
to the list of eggs to install, e.g.:
| [buildout] | eggs = | currency.converter
Tell the plone.recipe.zope2instance recipe to install a ZCML slug:
| [instance] | recipe = plone.recipe.zope2instance | zcml = | currency.converter
Re-run buildout, e.g. with:
| $ ./bin/buildout
To fetch the currency data regularly like every day, describe to the instance section of buildout.cfg the next way.
| [instance]
| zope-conf-additional =
| <clock-server>
| method /your_portal/@@get-currency
| period 86400
| user admin
| password admin_pass
| host localhost
| </clock-server>
FAQs
Currency Converter
We found that currency.converter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.