
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@deriv-com/api-client
Advanced tools
A lightweight, zero dependency wrapper around the WebSockets Web API
and the native Node WebSocket
(Node V22 and above) that is fully typed to Deriv's Backend WebSocket (Deriv WS API Explorer).
You can start by installing the library via the following commands:
npm i @deriv-com/api-client
pnpm install @deriv-com/api-client
yarn add @deriv-com/api-client
const derivAPI = new DerivAPIClient();
const response = await derivAPI.send({ name: 'get_account_status' });
console.log(response);
This project comes with a sandbox served with HMR. In it you have a sample code which you can test your changes. To run the sandbox run:
npm run dev
onData
) with WebSocket message streams - there will always be only one subscription per payload to Deriv WS BEconnecting
, disconnect
or reconnecting
response.error
propertyasync send({ name, payload })
The send method is for request/response Deriv WS call that do not have subscriptions. These types of call will only return one response for every call you make.
name
- typesafe to all deriv WS request/response endpoint names (TSocketEndpointNames
).payload
- typesafe to the expected payload (mapped to the name
). Default payload will always be set to { [name]: 1 }
. For example for the get_account_status
call, if no payload is passed will result in the following payload sent to the BE{
"get_account_status": 1
}
FAQs
A lightweight wrapper around Deriv's WebSocket API
We found that @deriv-com/api-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.