You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Today, the only official way of integrating Connect into an application requires it be downloaded from the unpkg.com CDN. This kind of centralization is bad for multiple reasons:
unpkg.com infrastructure is a single point of failure
everyone using Wormhole Connect is exposed to supply chain attacks on our NPM package. Such an attack happened to Ledger literally last week.
Given Connect's role as a wallet aggregator, it's especially attractive as an attack target. Developers should be able to host their own copies of Connect and not rely on the unpkg.com CDN.
Open questions:
What is the ideal way to let people bundle Connect into their own applications?
How do we deal with the fact that the current NPM package is published from wormhole-connect-loader, yet the actual source code lives inside wormhole-connect?
The text was updated successfully, but these errors were encountered:
Today, the only official way of integrating Connect into an application requires it be downloaded from the unpkg.com CDN. This kind of centralization is bad for multiple reasons:
Given Connect's role as a wallet aggregator, it's especially attractive as an attack target. Developers should be able to host their own copies of Connect and not rely on the unpkg.com CDN.
Open questions:
wormhole-connect-loader
, yet the actual source code lives insidewormhole-connect
?The text was updated successfully, but these errors were encountered: