
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@builderz/pump-science
Advanced tools
A Umi-compatible JavaScript library for interacting with the Pump.Science protocol on Solana.
First, if you're not already using Umi, follow these instructions to install the Umi framework.
Install the library:
npm install @builderz/pump-science
import { createUmi } from '@metaplex-foundation/umi-bundle-defaults';
import { keypairIdentity } from '@metaplex-foundation/umi';
import { PumpScienceSDK } from '@builderz/pump-science';
// Initialize Umi
const umi = createUmi('https://api.mainnet-beta.solana.com'); // Or devnet if used with dev environment
// Set up your wallet (replace with your keypair)
const wallet = umi.eddsa.generateKeypair();
umi.use(keypairIdentity(wallet));
// Initialize the SDK
const sdk = new PumpScienceSDK(umi);
interface LaunchTokenRequest {
cluster?: 'mainnet-beta' | 'devnet' | 'localhost';
description: string;
twitter?: string;
telegram?: string;
transaction: string; // base64 encoded transaction
links: Array<{
compound: string;
link: string;
}>;
compounds: Array<{
name: string;
}>;
}
import { LAMPORTS_PER_SOL } from '@solana/web3.js';
import { toWeb3JsTransaction } from '@metaplex-foundation/umi-web3js-adapters';
// Get fee receiver from global data
const { feeReceiver } = await sdk.fetchGlobalData();
// Generate a new mint keypair
const mintKeypair = umi.eddsa.generateKeypair();
// Get the curve SDK for this mint
const curveSdk = sdk.getCurveSDK(mintKeypair.publicKey, feeReceiver);
// Create bonding curve transaction
let txBuilder = curveSdk.createBondingCurve(
{
name: "My Token",
symbol: "MTK",
uri: "https://your-metadata-uri.com/metadata.json",
startSlot: null, // For immediate start
},
mintKeypair,
false // isWhitelistEnabled
);
// Add first buy if desired (max 1.5 SOL)
txBuilder = txBuilder.add(
curveSdk.swap({
direction: 'buy',
exactInAmount: 1.5 * LAMPORTS_PER_SOL, // MAX 1.5 SOL allowed
minOutAmount: 0,
})
);
// Build and sign transaction
const tx = txBuilder.build(umi);
const signedTx = await umi.identity.signTransaction(tx);
const web3Tx = toWeb3JsTransaction(signedTx);
const serializedTx = web3Tx.serialize();
// Prepare request body
const requestBody: LaunchTokenRequest = {
cluster: 'mainnet-beta', // optional: 'mainnet-beta' | 'devnet' | 'localhost'
description: "Revolutionary token for scientific research and innovation",
twitter: "https://twitter.com/mytoken",
telegram: "https://t.me/mytoken",
transaction: Buffer.from(serializedTx).toString('base64'),
links: [
{
compound: "compound-123",
link: "https://example.com/compound-123"
}
],
compounds: [
{
name: "Innovative Compound Alpha"
}
],
};
// Choose environment
const environment: 'dev' | 'prod' = 'prod';
const apiUrl = environment === 'prod'
? 'https://us-central1-pump-science-443711.cloudfunctions.net/prod/api'
: 'https://us-central1-pump-science-443711.cloudfunctions.net/dev/api';
// Submit transaction
const response = await fetch(`${apiUrl}/launch-token`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify(requestBody),
});
if (!response.ok) {
throw new Error(`API request failed: ${response.statusText}`);
}
const result = await response.json();
console.log('Token launched successfully:', result);
For a complete working example, see launch-token.ts in this directory.
const curveSdk = sdk.getCurveSDK(mintPublicKey, feeReceiver);
const buyTx = curveSdk.swap({
direction: 'buy',
exactInAmount: 0.1 * LAMPORTS_PER_SOL, // 0.1 SOL
minOutAmount: 0, // Calculate based on slippage tolerance
});
await buyTx.sendAndConfirm(umi);
const sellTx = curveSdk.swap({
direction: 'sell',
exactInAmount: 1000000n, // Amount in token's smallest unit
minOutAmount: 0, // Minimum SOL to receive
});
await sellTx.sendAndConfirm(umi);
FAQs
Pump Science
We found that @builderz/pump-science demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.