Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The @cod3x/sdk package is a comprehensive SDK that provides easy access to various blockchain functionalities. It supports multiple chains such as Ethereum, Solana, Bitcoin, Cosmos, EOS, Litecoin, Ripple, Tron, Bitcoincash, and Dogecoin. The SDK includes functionalities for managing accounts, interacting with DeFi protocols like Aave, Uniswap, and Yearn, and working with NFTs (ERC-20, ERC-721, and ERC-1155).
To utilize the codex SDK package, first install it to the desired directory of the project:
{% tabs %} {% tab title="npm" %}
npm install @cod3x/sdk
{% endtab %}
{% tab title="yarn" %}
yarn add @cod3x/sdk
{% endtab %}
{% tab title="pnpm" %}
pnpm add @cod3x/sdk
{% endtab %} {% endtabs %}
Here's a basic example of how to use the SDK:
import { CodexSDK } from '@cod3x/sdk';
const codexSDK = new CodexSDK({ apiKey: 'your-api-key' });
// List accounts
const accounts = await codexSDK.listAccounts();
console.log(accounts);
// Create a new account
const newAccount = await codexSDK.createAccount();
console.log(newAccount);
// Sign a transaction
const signedTx = await codexSDK.SignTransaction(wallet, transaction);
console.log(signedTx);
// Broadcast a transaction
const txHash = await codexSDK.SendTransaction(wallet, signedTx, chain_id);
console.log(txHash);
The codexSDK class emits various events that you can listen to in order to handle specific actions or errors. Here's an example of how to listen to events:
import { codexSDK } from '@cod3x/sdk';
const codexSDK = new CodexSDK();
codexSDK.on('accountCreated', (account) => {
console.log(`Account created: ${account}`);
});
codexSDK.on('transactionSigned', (signedTransaction) => {
console.log(`Transaction signed: ${signedTransaction}`);
});
codexSDK.on('messageSigned', (signedMessage) => {
console.log(`Message signed: ${signedMessage}`);
});
codexSDK.on('typedDataSigned', (signedTypedData) => {
console.log(`Typed data signed: ${signedTypedData}`);
});
codexSDK.on('transactionSent', (transactionHash) => {
console.log(`Transaction sent: ${transactionHash}`);
});
codexSDK.on('chainsFetched', (chains) => {
console.log(`Chains fetched: ${JSON.stringify(chains)}`);
});
codexSDK.on('chainFetched', (chain) => {
console.log(`Chain fetched: ${JSON.stringify(chain)}`);
});
codexSDK.on('error', (error) => {
console.error(`An error occurred: ${error.message}`);
});
The available events are:
accountCreated
: Emitted when a new account is created.transactionSigned
: Emitted when a transaction is signed.messageSigned
: Emitted when a message is signed.typedDataSigned
: Emitted when typed data is signed.transactionSent
: Emitted when a transaction is sent.chainsFetched
: Emitted when the list of supported chains is fetched.chainFetched
: Emitted when a specific chain is fetched.error
: Emitted when an error occurs.Constructor
new codexSDK(config?: CodexSDKConfig)
config
(optional): Configuration object for the SDK.
apiKey
(string): Your API key for authentication.authInstance
(SupabaseClient): An existing Supabase client instance for authentication.httpParams
(ApiConfig): Configuration for the HTTP client.httpInstance
(HttpClient): An existing HttpClient instance.Methods
connect(accessToken?: string, refreshToken?: string)
: Establishes a connection to the codex API.
await codexSDK.connect('access-token', 'refresh-token');
disconnect()
: Disconnects from the codex API.
await codexSDK.disconnect();
getcodexAuth()
: Returns the Supabase client instance for authentication.
const authClient = codexSDK.getCodexAuth();
getUserSession()
: Returns the current user session.
const session = await codexSDK.getUserSession();
getSolanaSDK()
: Returns the Solana SDK instance.
const solanaSDK = codexSDK.getSolanaSDK();
getBitcoinSDK()
: Returns the Bitcoin SDK instance.
const bitcoinSDK = codexSDK.getBitcoinSDK();
getCosmosSDK()
: Returns the Cosmos SDK instance.
const cosmosSDK = codexSDK.getCosmosSDK();
getEosSDK()
: Returns the EOS SDK instance.
const eosSDK = codexSDK.getEosSDK();
getLitecoinSDK()
: Returns the Litecoin SDK instance.
const litecoinSDK = codexSDK.getLitecoinSDK();
getRippleSDK()
: Returns the Ripple SDK instance.
const rippleSDK = codexSDK.getRippleSDK();
getTronSDK()
: Returns the Tron SDK instance.
const tronSDK = codexSDK.getTronSDK();
getBitcoincashSDK()
: Returns the Bitcoincash SDK instance.
const bitcoincashSDK = codexSDK.getBitcoincashSDK();
getDogecoinSDK()
: Returns the Dogecoin SDK instance.
const dogecoinSDK = codexSDK.getDogecoinSDK();
getAccountsSDK()
: Returns the Accounts SDK instance.
const accountsSDK = codexSDK.getAccountsSDK();
getAaveSDK()
: Returns the Aave SDK instance.
const aaveSDK = codexSDK.getAaveSDK();
getConveyorfinanceSDK()
: Returns the Conveyorfinance SDK instance.
const conveyorfinanceSDK = codexSDK.getConveyorfinanceSDK();
getENSSDK()
: Returns the ENS SDK instance.
const ensSDK = codexSDK.getENSSDK();
getErc20SDK()
: Returns the ERC-20 SDK instance.
const erc20SDK = codexSDK.getErc20SDK();
getErc1155SDK()
: Returns the ERC-1155 SDK instance.
const erc1155SDK = codexSDK.getErc1155SDK();
getErc721SDK()
: Returns the ERC-721 SDK instance.
const erc721SDK = codexSDK.getErc721SDK();
getOneinchSDK()
: Returns the 1inch SDK instance.
const oneinchSDK = codexSDK.getOneinchSDK();
getUniswapSDK()
: Returns the Uniswap SDK instance.
const uniswapSDK = codexSDK.getUniswapSDK();
getYearnSDK()
: Returns the Yearn SDK instance.
const yearnSDK = codexSDK.getYearnSDK();
listAccounts()
: Lists all available accounts.
const accounts = await codexSDK.listAccounts();
createAccount()
: Creates a new account.
const newAccount = await codexSDK.createAccount();
SignTransaction(wallet: string, transaction: InputBody)
: Signs a transaction.
const signedTx = await codexSDK.SignTransaction(wallet, transaction);
SignMessage(wallet: string, message: BytesLike)
: Signs a message.
const signedMessage = await codexSDK.SignMessage(wallet, message);
SignTypedData(wallet: string, domain: TypedDataDomain, types: Record<string, Array<TypedDataField>>, value: Record<string, string>)
: Signs typed data.
const signedTypedData = await codexSDK.SignTypedData(wallet, domain, types, value);
SendTransaction(wallet: string, rawTransaction: string, chain_id: string)
: Broadcasts a transaction.
const txHash = await codexSDK.SendTransaction(wallet, signedTx, chain_id);
getChains()
: Retrieves a list of supported chains.
const chains = await codexSDK.getChains();
getChainById(id: string)
: Retrieves a chain by its ID.
const chain = await codexSDK.getChainById('chain-id');
The codex SDK supports various authentication methods to provide secure access to the blockchain functionalities. The following authentication methods are available:
Here's a basic example of how to use the SDK:
import { codexSDK } from '@cod3x/sdk';
const codexSDK = new CodexSDK({ clientId: 'your-client-id' });
// Discord OAuth
await codexSDK.performDiscordOAuth();
// After obtaining the authorization code, exchange it for an access token and refresh token
const discordToken = await codexSDK.performDiscordOauthCodeExchange(code);
// GitHub OAuth
await codexSDK.performGithubOAuth();
// After obtaining the authorization code, exchange it for an access token and refresh token
const githubToken = await codexSDK.performGithubOauthCodeExchange(code);
// Google OAuth
await codexSDK.performGoogleOAuth();
// After obtaining the authorization code, exchange it for an access token and refresh token
const googleToken = await codexSDK.performGoogleOauthCodeExchange(code);
// Twitter OAuth
await codexSDK.performTwitterOauth();
// After obtaining the authorization code, exchange it for an access token and refresh token
const twitterToken = await codexSDK.performTwitterOauthCodeExchange(code);
// Magic Link
await codexSDK.sendMagicLink(email, redirectTo);
// Email and Password
await codexSDK.signUp(email, password);
await codexSDK.signInWithPassword(email, password);
// Phone and Password
await codexSDK.signInWithPhone(phone, password);
// Passkey
const passkeyOptions = await codexSDK.handlePassKeyLogin(email);
// Use the passkeyOptions to authenticate the user using their passkey
const passkeyResponse = await codexSDK.handlePasskeyLoginVerify(email, credential);
// SIWE (Sign-In with Ethereum)
const nonce = await codexSDK.getSIWENonce(address);
// Sign the SIWE message using the Ethereum wallet
const siweResponse = await codexSDK.verifySIWESignature(address, signedMessage, nonce, message);
// Embedded Account
const session = await codexSDK.embeddedAccount(email, uuid, domain);
To authenticate using Discord OAuth, follow these steps:
Initiate the Discord OAuth flow:
await codexSDK.performDiscordOAuth();
After the user is redirected to the Discord authorization page, obtain the authorization code from the URL.
Exchange the authorization code for an access token and refresh token:
const token = await codexSDK.performDiscordOauthCodeExchange(code);
To authenticate using GitHub OAuth, follow these steps:
Initiate the GitHub OAuth flow:
await codexSDK.performGithubOAuth();
After the user is redirected to the GitHub authorization page, obtain the authorization code from the URL.
Exchange the authorization code for an access token and refresh token:
const token = await codexSDK.performGithubOauthCodeExchange(code);
To authenticate using Google OAuth, follow these steps:
Initiate the Google OAuth flow:
await codexSDK.performGoogleOAuth();
After the user is redirected to the Google authorization page, obtain the authorization code from the URL.
Exchange the authorization code for an access token and refresh token:
const token = await codexSDK.performGoogleOauthCodeExchange(code);
To authenticate using Twitter OAuth, follow these steps:
Initiate the Twitter OAuth flow:
await codexSDK.performTwitterOauth();
After the user is redirected to the Twitter authorization page, obtain the authorization code from the URL.
Exchange the authorization code for an access token and refresh token:
const token = await codexSDK.performTwitterOauthCodeExchange(code);
To authenticate using a magic link, follow these steps:
Send a magic link to the user's email address:
await codexSDK.sendMagicLink(email, redirectTo);
The user will receive an email with a magic link. After clicking the link, they will be redirected to the specified redirectTo
URL.
To authenticate using email and password, follow these steps:
Create a new user account:
await codexSDK.signUp(email, password);
Sign in with the created account:
await codexSDK.signInWithPassword(email, password);
To authenticate using phone and password, follow these steps:
Sign in with the phone number and password:
await codexSDK.signInWithPhone(phone, password);
To authenticate using a passkey, follow these steps:
Initiate the passkey login flow:
const options = await codexSDK.handlePassKeyLogin(email);
Use the options
to authenticate the user using their passkey.
Verify the passkey login credentials:
const response = await codexSDK.handlePasskeyLoginVerify(email, credential);
To authenticate using SIWE, follow these steps:
Retrieve a nonce for the Ethereum address:
const nonce = await codexSDK.getSIWENonce(address);
Sign the SIWE message using the Ethereum wallet.
Verify the SIWE signature:
const response = await codexSDK.verifySIWESignature(address, signedMessage, nonce, message);
To create an embedded account, follow these steps:
Create an embedded account for the specified email address, UUID, and domain:
const session = await codexSDK.embeddedAccount(email, uuid, domain);
We welcome contributions to the @cod3x/sdk package! Here's how you can help:
If you find a bug or have a suggestion for improving the package:
main
.npm install
npm test
npm run lint:fix
npm run prettier:fix
main
branch.npm run build
: Build the packagenpm run dev
: Build and watch for changesnpm test
: Run testsnpm run coverage
: Run tests with coverage reportnpm run lint
: Check for linting errorsnpm run lint:fix
: Fix linting errorsnpm run prettier
: Check code formattingnpm run prettier:fix
: Fix code formattingnpm run verify
: Run linter and prettier checksnpm run verify:fix
: Fix linter and prettier issuesPlease follow the existing coding style. We use ESLint and Prettier to maintain code quality and consistency.
By contributing to @cod3x/sdk, you agree that your contributions will be licensed under its MIT License.
Thank you for your interest in improving @cod3x/sdk!
FAQs
## @cod3x/sdk Package Documentation
We found that @cod3x/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.