
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@coolwallets/core
Advanced tools
This package handles the apdu request for a CoolWalletS, also export a couple of classes to easily get started with CoolWalletS.
Use CWSDevice to register your current device, reset wallet or tune other settings.
Use CWSWallet to create or recover wallet in CoolWalletS.
npm i @coolwallets/sdk-core
For every APDU command, CoolWalletS will verify the identity of the requesting device (the App) by a digital signature, so we need to generate a key pair first for a new App.
import { generateKeyPair } from '@coolwallets/sdk-core'
const { publicKey: appPublicKey, privateKey: appPrivateKey } = generateKeyPair()
// store it locally on web storage
localStorage.setItem('appPublicKey', appPublicKey)
localStorage.setItem('appPrivateKey', appPrivateKey)
After we have our keys ready, we need to register our device (app) so the wallet can recognize us.
This can be done by the CWSDevice instance. In the constructor, we need to put in a Transport object for bluetooth transport, and the appPrivateKey we just generated to sign all the commands. Here's a example how to use web-ble-transport with CWSDevice
const transport = new WebBleTransport();
const device = new CWSDevice(transport, appPrivateKey)
You may notice that there's one more optional field called appId in the constructor, we don't have it yet so we will ignore it, and we will put the value in later with setAppId after we get our own appId from register.
device.register(appPublicKey, '123456', 'myFirstApp')
.then( appId =>{
localStorage.setItem("appId", appId)
device.setAppId(appId)
console.log(`Store AppId complete! ${appId}`)
})
Congrats! Now your App can communicate with the hardware wallet, If you need to pair another App with the wallet, use a registered App to call device.getPairingPassword() and use it as the second parameter in register()
You can use createWallet to securely generate a new master seed with the card, or use setSeed to recover one from a hex seed.
import { CWSWallet } from '@coolwallets/sdk-core'
const wallet = new CWSWallet(transport, appPrivateKey, appId)
wallet.createWallet(12).then(_ => {
// Sum all the seeds shown on CoolWalletS
wallet.sendCheckSum(873209).then( _ => {
console.log(`Successfully create a new wallet!`)
})
})
Build your own App with our sdk!
FAQs
Light core library of CoolWalletS apdu commands.
The npm package @coolwallets/core receives a total of 14 weekly downloads. As such, @coolwallets/core popularity was classified as not popular.
We found that @coolwallets/core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.