
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@chainsafe/web3.js-chainlink-plugin
Advanced tools
A Web3.js 4.x Plugin for Interacting With Chainlink Smart Contracts
This is a web3.js 4.x plugin for interacting with Chainlink Ethereum contracts.
yarn add @chainsafe/web3.js-chainlink-plugin
After importing ChainlinkPlugin from @chainsafe/web3.js-chainlink-plugin and Web3 from web3, register an instance of ChainlinkPlugin with an instance of Web3 like so:
import { ChainlinkPlugin } from '@chainsafe/web3.js-chainlink-plugin';
import Web3 from 'web3';
const web3 = new Web3('YOUR_PROVIDER_URL');
const chainlinkPlugin = new ChainlinkPlugin();
web3.registerPlugin(chainlinkPlugin);
More information about registering web3.js plugins can be found here.
Included in this plugin are two enums that contain the Ethereum contract addresses for specific token pairs: MainnetPriceFeeds and GoerliPriceFeeds. If you cannot find your desired price feed within these enums, please check here to make sure it's supported, and if it is, please open an issue or a pull request for the missing price feed so that it can be added to the appropriate enum.
getPriceasync getPrice(
priceFeedAddress: MainnetPriceFeeds | GoerliPriceFeeds | Address,
aggregatorInterfaceAbi: ContractAbi = defaultAggregatorInterfaceAbi,
): {
roundId: bigint,
answer: bigint,
startedAt: bigint,
updatedAt: bigint,
answeredInRound: bigint
}
defaultAggregatorInterfaceAbi can be found here.
The getPrice method, accepts MainnetPriceFeeds | GoerliPriceFeeds | Address for it's first parameter, and an optional second parameter for specifying the Chainlink Aggregator Interface ABI of the Ethereum smart contract you'd like to interact with (the parameter is defaulted to defaultAggregatorInterfaceAbi).
Under the hood, this method is calling the latestRoundData for the specified price feed, more information about it can be found here.
import { ChainlinkPlugin, MainnetPriceFeeds } from '@chainsafe/web3.js-chainlink-plugin';
import Web3 from 'web3';
const web3 = new Web3('YOUR_PROVIDER_URL');
const chainlinkPlugin = new ChainlinkPlugin();
web3.registerPlugin(chainlinkPlugin);
web3.chainlink.getPrice(MainnetPriceFeeds.LinkEth).then(console.log);
// {
// roundId: 73786976294838212867n,
// answer: 4185000000000000n,
// startedAt: 1674178043n,
// updatedAt: 1674178043n,
// answeredInRound: 73786976294838212867n
// }
yarn to install dependenciesyarn test:unit: Runs the mocked tests that do not make a network request using the Jest frameworkhttps://rpc.ankr.com/eth and returns an actual response from MainnetPriceFeeds.LinkEth smart contract using the Cypress framework
yarn test:e2e:chrome: Runs the tests using Chromeyarn test:e2e:electron: Runs the tests using Electronyarn test:e2e:firefox: Runs the tests using Firefoxhttps://rpc.ankr.com/eth and returns an actual response from MainnetPriceFeeds.LinkEth smart contract using the Jest framework
start: Start Verdaccio using a Docker containerstop: Kill the Docker containerstartBackgroundAndPublish: Starts a headless Docker container and publishes the plugin packagerunTests: cds into the test/black_box directory, installs the black box package dependencies, and runs yarn test which will use Jest to run the testsblack_box_test_helpers.sh script, the black box tests can be ran using the following package.json scripts:
yarn pre-black-box: Calls startBackgroundAndPublish from the black_box_test_helpers.sh scriptyarn test:black-box: Calls yarn pre-black-box and runTests from the from the black_box_test_helpers.sh scriptyarn post-black-box: Calls stop from the black_box_test_helpers.sh script| Script | Description |
|---|---|
| build | Uses tsc to build package and dependent packages |
| build:web | Uses webpack to build a browser ready build of the plugin in dist directory |
| clean | Uses rimraf to remove lib/ and dist/ |
| format | Uses prettier to format the code |
| lint | Uses eslint to lint package |
| lint:fix | Uses eslint to check and fix any warnings |
| post-black-box | Uses stop from black_box_test_helpers.sh to kill running Verdaccio Docker container |
| pre-black-box | Uses startBackgroundAndPublish from black_box_test_helpers.sh to start a Verdaccio Docker container and publish the plugin package to it |
| prebuild | Calls yarn clean |
| prepare | Installs husky |
| test | Uses jest to run unit tests |
| test:black-box | Calls yarn pre-black-box and runTests from black_box_test_helpers.sh to run black box tests |
| test:coverage | Uses jest to report test coverage |
| test:e2e:chrome | Users cypress to run e2e test in a Chrome environment |
| test:e2e:firefox | Users cypress to run e2e test in a Firefox environment |
| test:e2e:electron | Users cypress to run e2e test in a Electron environment |
| test:unit | Uses jest to run tests under /test/unit |
FAQs
A Web3.js 4.x Plugin for Interacting With Chainlink Smart Contracts
We found that @chainsafe/web3.js-chainlink-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.