
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@decentralchain/oracle-data
Advanced tools
Official TypeScript SDK for parsing, encoding, validating, and diffing oracle data on the DecentralChain blockchain — provider identity, asset verification, and data transaction field utilities
Oracle data parsing and encoding utilities for the DecentralChain blockchain.
Provides structured access to on-chain oracle data entries — defining how oracle key-value data is encoded, decoded, and validated. Parse data transaction fields into typed provider and asset objects, convert them back to fields, and compute diffs between data states.
Part of the DecentralChain SDK.
npm install @decentralchain/oracle-data
Requires Node.js >= 24 and an ESM environment (
"type": "module").
import {
getProviderData,
getProviderAssets,
getFieldsFromData,
getFieldsFromAsset,
getDifferenceByData,
getDifferenceByFields,
getFields,
} from '@decentralchain/oracle-data';
// Parse oracle provider data from on-chain data transaction fields
const providerResult = getProviderData(dataTxFields);
if (providerResult.status === 'ok') {
console.log(providerResult.content.name);
}
// Parse oracle asset data
const assets = getProviderAssets(dataTxFields);
// Convert provider data back to data transaction fields
const fields = getFieldsFromData(providerResult.content);
// Convert asset data back to fields
const assetFields = getFieldsFromAsset(asset);
// Get the diff between two provider data objects
const diff = getDifferenceByData(oldProvider, newProvider);
// Get the diff between two sets of raw fields
const fieldDiff = getDifferenceByFields(oldFields, newFields);
// Auto-detect provider vs asset and convert to fields
const autoFields = getFields(dataOrAsset);
getProviderData(dataTxFields) — Parse oracle provider data from an array of data transaction fields. Returns TResponse<IProviderData>.getProviderAssets(dataTxFields) — Parse oracle asset data from an array of data transaction fields. Returns TResponse<TProviderAsset>[].getFieldsFromData(data) — Convert provider data back to data transaction fields.getFieldsFromAsset(data) — Convert asset data back to data transaction fields.getFields(data) — Auto-detect type and convert to data transaction fields.getDifferenceByData(previous, next) — Compute diff between two data objects of the same type.getDifferenceByFields(previous, next) — Compute diff between two arrays of data transaction fields.IProviderData — Oracle provider metadata (name, link, email, version, description).IProviderAsset / TProviderAsset — Oracle asset data (id, status, ticker, logo, etc.).TDataTxField — A single data transaction field (string, integer, boolean, or binary).TResponse<T> — Success or error response wrapper.STATUS_LIST — Asset verification status enum.DATA_ENTRY_TYPES — Data entry type identifiers..node-version)git clone https://github.com/Decentral-America/oracle-data.git
cd oracle-data
npm install
| Command | Description |
|---|---|
npm run build | Build distribution files (ESM + CJS) |
npm test | Run tests with Vitest |
npm run test:watch | Tests in watch mode |
npm run test:coverage | Tests with V8 coverage |
npm run typecheck | TypeScript type checking |
npm run lint | ESLint |
npm run lint:fix | ESLint with auto-fix |
npm run format | Format with Prettier |
npm run format:check | Check formatting |
npm run check:publint | Validate package structure |
npm run check:exports | Validate type exports |
npm run check:size | Check bundle size budget |
npm run validate | Full CI validation pipeline |
npm run bulletproof | Format + lint fix + typecheck + test |
npm run bulletproof:check | CI-safe: check format + lint + tc + test |
All PRs must pass:
npm run lint)npm run typecheck)npm run check:size)npm run check:publint && npm run check:exports)| Package | Description |
|---|---|
@decentralchain/ts-types | Core TypeScript type definitions |
@decentralchain/data-entities | Asset, Money, and OrderPrice models |
@decentralchain/node-api-js | Node REST API client |
@decentralchain/transactions | Transaction builders and signers |
See CONTRIBUTING.md.
To report a vulnerability, see SECURITY.md.
MIT — Copyright (c) DecentralChain
FAQs
Official TypeScript SDK for parsing, encoding, validating, and diffing oracle data on the DecentralChain blockchain — provider identity, asset verification, and data transaction field utilities
We found that @decentralchain/oracle-data demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.