Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a basic library to support creating and manipulating programs written in UPLC.
Install anything between python 3.8 and 3.11. Then run
pip install uplc
If you want to use the builtin functions for verification of ECDSA and Schnorr signatures,
follow the instructions to install libsecp256k1
with schnorr support enabled:
This makes sure that the exact same version is used that is used in the cardano-node
.
This tool may be used to parse, reformat (/dump), evaluate or build contract artifacts from UPLC code.
# Check validity of a source file
uplc parse examples/fibonacci.uplc
# Dump a source file in either the official plutus or legacy aiken dialect
uplc dump examples/fibonacci.uplc --dialect plutus --unique-varnames
uplc dump examples/fibonacci.uplc --dialect legacy-aiken
# Evaluate a UPLC program on UPLC input
uplc eval examples/fibonacci.uplc "(con integer 5)"
# Build smart contract artifacts from the UPLC program
uplc build examples/fibonacci.uplc
# This package can also be used to analyze built contracts (output from any Smart Contract Language)
uplc dump build/fibonacci/script.cbor --from-cbor
# You can also apply additional parameters to a script using the build command
uplc build script.cbor --from-cbor "(con integer 5)"
# Show all options
uplc --help
This is a side product of the development of a pythonic smart contract language for the Cardano blockchain and hence much tailored to the needs of that development.
Most likely it can do what you would like to do but its not properly documented. Please do reach out via Discord or GitHub issue if you think this tool could be of use to you.
Contributions are very welcome.
FAQs
Python implementation of untyped plutus language core
We found that uplc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.