Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
A Python API client for TRISA Envoy nodes.
Envoy is a secure messaging tool designed for travel rule data exchanges, ensuring compliance using the TRISA (Travel Rule Information Sharing Architecture) and TRP (Travel Rule Protocol) protocols.
Virtual Asset Service Providers (VASPs) can deploy an Envoy node in order to interact with the compliance network using peer-to-peer messaging. The pyenvoy
package allows VASPs to interact with their Envoy node programatically in Python so that they can:
The API allows users to treat Envoy as their boundary node to compliance networks, and integrate travel rule data exchanges with their transaction processing systems or internal compliance tools.
You will need to deploy or host an Envoy node at a URL accessible by the client, then generate an API key and save the client ID and secret for the keys.
You can install PyEnvoy as follows:
$ pip install -U pyenvoy
Set the following environment variables:
$ENVOY_URL
: the url of your Envoy API, e.g. "https://myenvoy.tr-envoy.com/"
$ENVOY_CLIENT_ID
: the client ID of your API keys$ENVOY_CLIENT_SECRET
: the client secret for your API keysIf you're using the connect()
function, you can also store these variables in a .env
file in your current working directory.
Create an envoy client:
from envoy import connect
envoy = connect()
This will create the client and load the environment variables. You can test your connection to the server:
>>> envoy.status()
{'status': 'ok', 'uptime': '71h33m42.068692289s', 'version': '0.24.0-beta.28 (019fd7e)'}
Which should return the status, uptime, and version of your envoy node. Note that the status
endpoint does not require authentication, so this will not check if your credentials are correct.
The Envoy API is implemented as a RESTful architecture. To that end, each resource in the API can generally be accessed with list
, create
, detail
, update
, and delete
methods and may have other associated actions such as send
for transactions. For example, to get a list of counterparties from the server you would use:
envoy.counterparties.list()
Or to create a customer account you would:
account_data = {...}
envoy.accounts.create(account_data)
All resources are named on the envoy.Client
and are accessed as properties of the client; each of their methods can then be used to interact with the resource.
For advanced usage, note that the client also has get
, post
, put
, and delete
methods, in which you can directly make requests to the Envoy node.
Envoy specific errors will be a subclass of EnvoyError
. An ServerError
is raised when the Envoy node returns a 500 status code, and a ClientError
is raised when the node returns a 400 status code. AuthenticationError
is returned when no api key credentials are specified or the Server returns a 401 or 403 status code.
Note that all API keys have a set of permissions that defines what actions they can take, if your API keys do not have the required permissions for an action, an AuthenticationError
will be raised.
FAQs
An API client for TRISA Envoy nodes that enables travel rule compliance.
We found that pyenvoy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.