Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
https://pypi.org/project/diem/
>>> from diem import jsonrpc, testnet
>>> client = jsonrpc.Client(testnet.JSON_RPC_URL)
>>> client.get_metadata()
version: 3300304
timestamp: 1601492912847973
chain_id: 2
You can find more examples under the examples
directory:
Note: make test
runs all examples too, see the Makefile for details.
Checkout MiniWallet implementation for off-chain service implementation example.
See mini_wallet.md
make init
make test
run specific test:
make test t=<test file / test name match pattern>
run with local docker testnet (requires initializing diem submodule):
make test t=<test file / test name match pattern> dt=1
git submodule update --init diem
cd diem
git pull origin main
cd ..
make gen
SPEC = specification
DIP-X = Diem Improvement Protocol
Root module name: diem
Sub-modules:
jsonrpc
: diem JSON-RPC APIs client and API response types. SPECstdlib
: generated code, move stdlib script utils for constructing transaction script playload.diem_types
: generated code, Diem on-chain data structure types for encoding and decoding BCS data.utils
: utility functions, account address utils, currency code, hashing, hex encoding / decoding, transaction utils.AuthKey
| auth_key
: auth key utilsidentifier
: Diem Account Identifier and Diem Intent Identifier. DIP-5txnmetadata
: utils for creating peer to peer transaction metadata. DIP-4testnet
: Testnet utility, minting coins, create Testnet client, chain id, Testnet JSON-RPC URL.testing
: Testing utility, MiniWallet application, MiniWallet test suites, LocalAccount
for managing local account keys and generating random local account.chain_ids
: list of static chain idsFAQs
The Python Client SDK for Diem
We found that diem demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.