Fix/ledger session usb by ByteZhang1024 · Pull Request #803 · OneKeyHQ/hardware-js-sdk

ByteZhang1024 · 2026-05-24T15:00:48Z

No description provided.

revan-zhang · 2026-05-24T15:01:09Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2026-05-24T15:02:22Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `cipher-base` is missing type checks, leading to hash rewind and passing on crafted data CVE: GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 1.0.5 Patched version: 1.0.5 From: `?` → `npm/ripple-keypairs@1.3.0` → `npm/cipher-base@1.0.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cipher-base@1.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: `?` → `npm/ripple-keypairs@1.3.0` → `npm/elliptic@6.5.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/elliptic@6.5.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Arbitrary code execution in npm `protobufjs` CVE: GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs (CRITICAL) Affected versions: >= 8.0.0 < 8.0.1; < 7.5.5 Patched version: 7.5.5 From: `?` → `npm/@onekeyfe/hd-common-connect-sdk@1.1.15` → `npm/protobufjs@6.11.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@6.11.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: npm `sha.js` is missing type checks leading to hash rewind and passing on crafted data CVE: GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 2.4.12 Patched version: 2.4.12 From: `?` → `npm/ripple-keypairs@1.3.0` → `npm/sha.js@2.4.11` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/sha.js@2.4.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: `?` → `npm/cheerio@1.0.0-rc.12` → `npm/entities@4.5.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/entities@4.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `entities` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: `?` → `npm/nextra@4.6.0` → `npm/entities@6.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/entities@6.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Harden Ledger USB session/connection handling so multi-Ledger or replug scenarios can't route calls to the wrong device: - Reject multiple USB devices instead of auto-selecting by ephemeral path (new DeviceOneDeviceOnly error; added to ORPHAN_ELIGIBLE_ERROR_CODES so a batch aborts on it). - ensureConnected does the ambient first-session fallback only when the caller passed no connectId; an explicit miss re-resolves THAT device. - Make device-state subscription setup fatal: on failure, disconnect the just-created DMK session so no ghost entry leaks into _sessions. - Evict any pre-existing session before opening a new USB connection. Scope: Ledger-only (hwk-ledger-adapter / hwk-adapter-core). Does not touch the OneKey SDK stack.

Addresses review feedback on multi-USB handling: - searchDevices() no longer rejects when multiple USB devices are present; it returns the full list so an explicit connectId can resolve its target. - _connectFirstOrSelect rejects multiple devices only on the no-target auto-connect path; an explicit connectId connects that device (or the sole USB device after an ephemeral-path replug) and otherwise fails not-found.

socket-security · 2026-05-27T10:39:43Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Quality
	next@16.0.10
	nextra@4.6.0
	@ai-sdk/react@3.0.110
	lodash@4.17.21
	buffer@6.0.3
	events@3.3.0
	string_decoder@1.3.0
	process@0.11.10
	stream-browserify@3.0.0
	nextra-theme-docs@4.6.0
	@onekeyfe/hd-common-connect-sdk@1.1.15
	@types/react@19.2.7
	@reactour/tour@3.8.0
	lottie-react@2.4.1
	@types/node@16.18.105 ⏵ 24.10.1	⁺¹
	ripple-keypairs@1.3.0
	postcss@8.5.6
	remark-gfm@4.0.1
	react-markdown@10.1.0
	@xstate/react@6.0.0
	tailwindcss@4.1.17
	react@19.2.0
	cheerio@1.0.0-rc.12
	gsap@3.14.2
	assert@2.0.0
	prismjs@1.30.0
	prism-react-renderer@2.4.1
	autoprefixer@10.4.22
	pagefind@1.4.0
	@noble/hashes@1.4.0 ⏵ 1.3.1
	parcel@2.9.3
	typescript@5.9.3
	react-dom@19.2.0
See 6 more rows in the dashboard

View full report

originalix reviewed May 25, 2026

View reviewed changes

Comment thread packages/hwk-ledger-adapter/src/adapter/LedgerAdapter.ts Outdated

originalix reviewed May 25, 2026

View reviewed changes

Comment thread packages/hwk-ledger-adapter/src/connector/LedgerConnectorBase.ts Outdated

ByteZhang1024 mentioned this pull request May 25, 2026

Fix/ledger usb limit OneKeyHQ/app-monorepo#11765

Merged

ByteZhang1024 force-pushed the fix/ledger-session-usb branch from ff7a6e1 to 85eeac7 Compare May 25, 2026 04:55

originalix reviewed May 26, 2026

View reviewed changes

Comment thread packages/hwk-ledger-adapter/src/adapter/LedgerAdapter.ts Outdated

ByteZhang1024 added 3 commits May 27, 2026 14:52

fix(ledger): guard USB fallback with fingerprint

345d9fc

ByteZhang1024 force-pushed the fix/ledger-session-usb branch from 85eeac7 to 345d9fc Compare May 27, 2026 10:15

chore(release): 1.1.27-alpha.4

b69637a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix/ledger session usb#803

Fix/ledger session usb#803
ByteZhang1024 wants to merge 4 commits into
onekeyfrom
fix/ledger-session-usb

ByteZhang1024 commented May 24, 2026

Uh oh!

revan-zhang commented May 24, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ByteZhang1024 commented May 24, 2026

Uh oh!

revan-zhang commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

socket-security Bot commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

revan-zhang commented May 24, 2026 •

edited

Loading

socket-security Bot commented May 24, 2026 •

edited

Loading