
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@defuse-protocol/crosschain-assetid
Advanced tools
npm install @defuse-protocol/crosschain-assetid
import {parse1cs, stringify1cs} from '@defuse-protocol/crosschain-assetid';
const assetid = stringify1cs({
version: "v1",
chain: "eth",
namespace: "erc20",
reference: "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
})
const obj = parse1cs("1cs_v1:eth:erc20:0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48")
1cs_v1 is a URL-safe, compact, human-readable identifier format for
representing any asset (crypto token, NFT, native coin, wrapped/bridged asset,
or even fiat) across chains in a consistent way.
It is designed to:
1cs_v1:<chain>:<namespace>:<reference>[:<selector>]
| Part | Required? | Description |
|---|---|---|
1cs_v1 | ✅ | Format prefix and version. 1cs stands for 1ClickSwap. |
<chain> | ✅ | Lowercase slug (e.g. eth, eth-sepolia, solana, near, polygon), can encode testnet in slug. |
<namespace> | ✅ | Asset standard/kind: erc20, erc721, spl, near-nft, aptos-coin, fiat, etc. |
<reference> | ✅ | Contract/mint/account/denom/issuer — URI-encoded to safely hold :, /, spaces, unicode, etc. |
<selector> | optional | Sub-asset selector: token ID, module struct, Stellar code, etc. — also URI-encoded. |
1cs_v1:eth:erc20:0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 # USDC on Ethereum
1cs_v1:base:erc20:0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 # USDC on Base
1cs_v1:fiat:iso4217:USD # US Dollar (fiat)
1cs_v1:eth:erc721:0x1234567890abcdef1234567890abcdef12345678:42
1cs_v1:near:nep171:apes.coolnft.near:series%3A1%2Fblue%3A42
1cs_v1:eth:native:coin
1cs_v1:zcash:native:coin
1cs_v1:solana:spl:EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
1cs_v1:aptos:aptos-coin:0x1%3A%3Aaptos_coin%3A%3AAptosCoin
We encode reference and selector with encodeURIComponent so they are safe in URLs.
1cs_v1) makes it clear what format is in use. Easy greppable across codebase.selector cleanly supports ERC-1155 IDs, Stellar asset codes, Cosmos token sub-denoms, Aptos/Sui struct names, etc.
The ID identifies the on-chain representation. If you need to express the origin, bridge, issuer, or other metadata — pass it as query params or in your object model, not in the core ID.
Parsing a 1cs_v1 string gives you:
interface OneCsAsset {
version: "v1";
chain: string; // e.g. "eth", "near", "fiat"
namespace: string; // e.g. "erc20", "spl", "native"
reference: string; // decoded from URI
selector?: string; // decoded from URI if present
}
Example:
1cs_v1:near:nep171:apes.coolnft.near:series%3A1%2Fblue%3A42
↓
{
version: "v1",
chain: "near",
namespace: "nep171",
reference: "apes.coolnft.near",
selector: "series:1/blue:42"
}
FAQs
## Installation
We found that @defuse-protocol/crosschain-assetid demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.