
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@arkade-os/snap
Advanced tools
Arkade Wallet Snap - Bitcoin Layer 2 wallet with Arkade protocol support
A MetaMask Snap that brings Bitcoin Layer 2 functionality to your browser via the Ark protocol. This snap enables instant off-chain Bitcoin transactions (VTXOs), Lightning Network payments, and self-custodial Bitcoin management.
await ethereum.request({
method: 'wallet_requestSnaps',
params: {
'npm:@arkade-os/snap': {}
}
});
The Arkade Wallet Snap provides a minimal signing interface with 3 focused RPC methods:
const response = await ethereum.request({
method: 'wallet_invokeSnap',
params: {
snapId: 'npm:@arkade-os/snap',
request: {
method: 'arkade_getPublicKey'
}
}
});
// Returns:
// {
// compressedPublicKey: "02...", // 33 bytes hex
// xOnlyPublicKey: "..." // 32 bytes hex
// }
const response = await ethereum.request({
method: 'wallet_invokeSnap',
params: {
snapId: 'npm:@arkade-os/snap',
request: {
method: 'arkade_getAddress',
params: {
network: 'bitcoin', // 'bitcoin' | 'testnet' | 'signet' | 'mutinynet' | 'regtest'
signerPubkey: '...', // Server's x-only public key (64 hex chars)
unilateralExitDelay: '512' // CSV timelock value from server
}
}
}
});
// Returns:
// {
// address: "ark1..." // Bech32m-encoded Ark address
// }
const response = await ethereum.request({
method: 'wallet_invokeSnap',
params: {
snapId: 'npm:@arkade-os/snap',
request: {
method: 'arkade_signPsbt',
params: {
psbt: 'cHNidP8B...', // Base64-encoded PSBT
inputIndexes: [0, 1] // Indexes of inputs to sign
}
}
}
});
// Returns:
// {
// psbt: 'cHNidP8B...' // Base64-encoded signed PSBT
// }
This snap uses a simplified provider pattern where the snap only handles Bitcoin key management and signing operations. All wallet logic (balance queries, transaction history, Lightning operations) runs in your frontend application using the Arkade SDK.
┌─────────────────────────────────────────┐
│ Your Dapp │
│ ┌────────────────────────────────┐ │
│ │ Arkade SDK Wallet │ │
│ │ - Balance queries │ │
│ │ - Transaction history │ │
│ │ - Lightning operations │ │
│ │ - VTXO management │ │
│ └──────────┬─────────────────────┘ │
│ │ │
│ │ (signing requests only) │
│ ▼ │
│ ┌────────────────────────────────┐ │
│ │ Arkade Wallet Snap │ │
│ │ - arkade_getPublicKey() │ │
│ │ - arkade_getAddress() │ │
│ │ - arkade_signPsbt() │ │
│ └────────────────────────────────┘ │
└─────────────────────────────────────────┘
To use this snap in your application, integrate it with the Arkade SDK using the MetaMaskSnapIdentity provider:
import { Wallet } from '@arkade-os/sdk';
import { MetaMaskSnapIdentity } from './MetaMaskSnapIdentity';
// Create identity provider
const identity = new MetaMaskSnapIdentity(
'npm:@arkade-os/snap',
ethereum
);
// Create Arkade wallet
const wallet = new Wallet({
identity,
esploraUrl: 'https://blockstream.info/api',
arkServerUrl: 'https://ark.arkadeos.com'
});
// Use wallet methods
const balance = await wallet.getBalance();
const address = await wallet.getAddress();
For a complete implementation example, see the reference dapp.
This snap requires the following MetaMask permissions:
snap_getEntropy - Derive deterministic Bitcoin keys from MetaMask entropyendowment:rpc - Accept RPC calls from dappsendowment:network-access - Connect to Ark servers (for address validation)snap_manageState - Persist configurationgit clone https://github.com/arkade-os/snap.git
cd arkade-snap/packages/snap
pnpm install
pnpm build
pnpm test
pnpm start
# Snap serves at http://localhost:8080
MIT License - see LICENSE for details
Contributions are welcome! Please feel free to submit a Pull Request.
Built with MetaMask Snaps SDK and Arkade SDK
FAQs
Arkade Wallet Snap - Bitcoin Layer 2 wallet with Arkade protocol support
The npm package @arkade-os/snap receives a total of 7 weekly downloads. As such, @arkade-os/snap popularity was classified as not popular.
We found that @arkade-os/snap demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.