search

floating / frame

System-wide Web3 for macOS, Windows and Linux
https://frame.sh
GNU General Public License v3.0
1.05k stars 140 forks source link

Security issue: hdkey package #1552

Open paulmillr opened 1 year ago

paulmillr commented 1 year ago

It's pretty old and uncool. Uses a lot of sub-deps. Unaudited subdeps which could be updated by different authors is a supply chain security issue.

The suggestion is to switch to https://github.com/paulmillr/scure-bip32 which is being used by ethereum-cryptography in your dep tree. Scure has been audited, paid for by EF.

bip39 could also be replaced with scure-bip39.

ckLee8 commented 1 year ago

duplicate of #1526

paulmillr commented 1 year ago

not really a duplicate, more an extension: hdkey != bip39

ai-slave commented 1 year ago

I feel like the priority of this should be bumped