
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
@coinflowlabs/react
Advanced tools
import {useWallet} from '@solana/wallet-adapter-react';
const wallet = useWallet();
const connection = useConnection();
<CoinflowWithdraw wallet={wallet} merchantId='<YOUR MERCHANT ID>' env='prod|sandbox' connection={connection} />;
Props:
wallet: The Solana Wallet Adapter WalletmerchantId: Your Merchant ID (Contact Coinflow support for this)connection: Solana Connectionenv (optional): This defaults to prod
sandboxonSuccess (optional): function to run when the withdrawal process is successfullockAmount (optional): Whether to let the user select the amount to withdraw or to disable the inputamount (optional): The amount to withdraw - required if lockAmount=truetokens (optional): Define a list to filter the available tokenslockDefaultToken (optional): Only allow the default token to be usedemail (optional): Set the default email to be used in entry fieldsbankAccountLinkRedirect (optional): The URL to be used for bank account setupadditionalWallets (optional): Define additional wallets to assign to the userusePermit (optional): Pass as false to disable permit message signing for EVM and use approve transactionstransactionSigner (optional): Public Key of the wallet which will actually execute the withdrawal transaction. Must be associated with the same withdrawer as the main wallet.import {useWallet} from '@solana/wallet-adapter-react';
const wallet = useWallet();
const connection = useConnection();
<CoinflowPurchase wallet={wallet} merchantId='<YOUR MERCHANT ID>' env='prod|sandbox|staging' connection={connection} />;
Props:
subtotal (optional): Fix the amount of purchasewallet: The Solana Wallet Adapter WalletmerchantId: Your Merchant ID (Contact Coinflow support for this)connection: Solana Connectionenv (optional): This defaults to prod
stagingonSuccess (optional): function to run when the purchase process is successfultransaction (optional): transaction for the user to run which redeems their credits with your smart contract. Create this transaction just like you would for a normal user who has USDC in their account.debugTx (optional): Setting this to true will sign the transaction with the wallet, and send the transaction with no preflight checks allowing for easier debug of any issues.planCode (optional): When a subscription is being purchased, the code of the subscription plan.settlementType (optional): The settlement method to use for the proceeds of a purchase. (Credits, USDC, or Bank)webhookInfo (optional): Product or transaction based information that you want transmitted when you receive webhooks regarding the purchaseemail (optional): Set the default email to use in email entry fieldschargebackProtectionData (optional):customerInfo (optional): Additional information about the customerallowedPaymentMethods (optional): The payment methods displayed on the UI. If omitted, all available payment methods will be displayed.rent (optional, Solana only): Specify the blockchain rent amount to add to the totalnativeSolToConvert (optional, Solana only): Specify the amount of native SOL to convert wSOL for the purchasejwtToken (optional): A JWT token which encodes verified checkout parameters to prevent spoofing of arguments.supportEmail (optional): Your business support email address to use for support inquirieszeroAuthorization (optional): Pass in true if you wish to perform a zero authorization card transactionCoinflowUtils
getFeePayer - Return the PublicKey of the Coinflow Fee PayerredemptionCheck to purchase (Solana only)allowedWithdrawSpeeds query parameter to allow merchants to specify what withdraw speeds are allowed. The default is all.chargebackProtectionData product typespartialUsdcChecked property to pre-check partial USDC payment checkboxpresentment propertyonAuthDeclined callbackseller prop to chargebackProtectionDataallowedPaymentMethods to CoinflowPurchaseonAuthDeclined callback to CoinflowPurchaseamount and token in favor of subtotal which can be accessed via the following ways:{
cents: number;
currency: 'USD' | 'EUR' | 'GBP' | 'BRL';
}
or
{
address: string;
amount: number;
}
CoinflowWithdrawCoinflowPurchaseonError callback to Apple Pay and Google Pay buttonsgetWalletFromEmail function to CoinflowUtilssignMessage on wallets for stronger withdraw authenticationwaitForHash to EvmTransactionDatatheme props to Coinflow components for easy color controlorderId option for reservoir itemsnativeSolToConvert for Solana transactionsCoinflowPurchaseProtection to make partnerId requiredBreaking Changes
supportsVersionedTransactions in CoinflowWithdraw to false.CoinflowCardForm component which allows merchants to collect credit card information from their users in a PCI compliant way. Tokenize it, and then utilize the remainder of Coinflow's APIs.ChargebackProtectionDatatoken prop for CoinflowPurchase with polygonSupport Versioned Transactions in CoinflowPurchase
Added useSocket property to handle browser instances where iframe messages are unavailable
CoinflowUtils.getFeePayer() to get the Coinflow fee payer PublicKeyFAQs
React Component for Coinflow Withdraw
The npm package @coinflowlabs/react receives a total of 4,537 weekly downloads. As such, @coinflowlabs/react popularity was classified as popular.
We found that @coinflowlabs/react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.