
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
@defuse-protocol/one-click-sdk-typescript
Advanced tools
A powerful TypeScript SDK for seamless cross-chain token swaps using the 1Click API. Built with type safety in mind, this SDK enables developers to easily integrate cross-chain swapping functionality into their applications with minimal setup.
# Using npm
npm install @defuse-protocol/one-click-sdk-typescript
# Using yarn
yarn add @defuse-protocol/one-click-sdk-typescript
# Using pnpm
pnpm add @defuse-protocol/one-click-sdk-typescript
import { OpenAPI, QuoteRequest, OneClickService } from '@defuse-protocol/one-click-sdk-typescript';
// Initialize the API client
OpenAPI.BASE = 'https://1click.chaindefuser.com';
// Configure your JSON Web Token (JWT) - required for most endpoints
// Request one here:
// https://docs.google.com/forms/d/e/1FAIpQLSdrSrqSkKOMb_a8XhwF0f7N5xZ0Y5CYgyzxiAuoC2g4a2N68g/viewform
OpenAPI.TOKEN = "your-JSON-Web-Token";
// Create a quote request
// See docs for more info:
// https://docs.near-intents.org/near-intents/integration/distribution-channels/1click-api#post-v0-quote
const quoteRequest: QuoteRequest = {
dry: true, // set to true for testing / false to get `depositAddress` and execute swap
swapType: QuoteRequest.swapType.EXACT_INPUT,
slippageTolerance: 100, // 1%
originAsset: 'nep141:arb-0xaf88d065e77c8cc2239327c5edb3a432268e5831.omft.near', // USDC on Arbitrum
depositType: QuoteRequest.depositType.ORIGIN_CHAIN,
destinationAsset: 'nep141:sol-5ce3bf3a31af18be40ba30f721101b4341690186.omft.near', // USDC on Solana
amount: '1000000', // 1 USDC (in smallest units)
refundTo: '0x2527D02599Ba641c19FEa793cD0F167589a0f10D', // Valid Arbitrum address
refundType: QuoteRequest.refundType.ORIGIN_CHAIN,
recipient: '13QkxhNMrTPxoCkRdYdJ65tFuwXPhL5gLS2Z5Nr6gjRK', // Valid Solana Address
recipientType: QuoteRequest.recipientType.DESTINATION_CHAIN,
deadline: "2025-08-06T14:15:22Z"
};
// Get quote
const quote = await OneClickService.getQuote(quoteRequest);
See official API docs for more info on endpoints.
const quote = await OneClickService.getQuote(quoteRequest);
const status = await OneClickService.getExecutionStatus(depositAddress);
const result = await OneClickService.submitDepositTx({
txHash: '0x...',
depositAddress: '0x...'
});
The 1Click API requires JWT authentication for most endpoints -> Request yours here
// Set a static JWT - required for authenticated endpoints
OpenAPI.TOKEN = 'your-JSON-Web-Token';
// Set a function that returns a fresh token when needed
OpenAPI.TOKEN = async () => {
// Get a fresh token from your authentication system
return 'FRESH_JWT';
};
The following endpoints require JWT authentication:
OneClickService.getQuote()OneClickService.submitDepositTx()OneClickService.getExecutionStatus()The SDK throws typed errors that you can catch and handle:
try {
const quote = await OneClickService.getQuote(quoteRequest);
} catch (error) {
if (error instanceof ApiError && error.status === 401) {
// Handle authentication errors
console.error('Authentication failed: JWT is missing or invalid');
} else if (error instanceof ApiError && error.status === 400) {
// Handle bad request
console.error('Invalid request:', error.body);
} else {
// Handle other errors
console.error('Error:', error);
}
}
ISC - See LICENSE for details.
For SDK developers (not SDK users), here are the development commands:
# Install dependencies
pnpm install
# Generate fresh SDK from latest API spec
pnpm generate:fresh
# Build the SDK
pnpm build
# Clean build artifacts
pnpm clean
FAQs
TypeScript SDK for 1Click API
The npm package @defuse-protocol/one-click-sdk-typescript receives a total of 3,166 weekly downloads. As such, @defuse-protocol/one-click-sdk-typescript popularity was classified as popular.
We found that @defuse-protocol/one-click-sdk-typescript demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.