
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@deserialize/swap-sdk
Advanced tools
The Swap SDK is a TypeScript library that simplifies interacting with a Deserialize swap endpoint. It abstracts away the low-level details of converting between SVM types (e.g., PublicKey, Keypair) and the API’s JSON formats. Use it to easily construct swap transactions or retrieve underlying instructions for advanced scenarios.
PublicKey objects and numerical amounts while handling all necessary conversions.VersionedTransaction and applies signatures.swapTx) or the raw instructions (using swapIx) for manual transaction assembly.Install the package via npm (or yarn):
npm install @deserialize/swap-sdk
# or
yarn add @deserialize/swap-sdk
Below is a simple example of how to use the SDK in your project:
// index.ts
import { SwapSDK } from "@deserialize/swap-sdk";
import { Buffer } from "buffer";
(async () => {
const deserialize = new SwapSDK();
const privKey = "PRIVATE_KEY";
const privateKeyArray = deserialize.base58.decode(privKey);
const userKeyPair = deserialize.web3.Keypair.fromSecretKey(privateKeyArray);
const params = {
tokenB: new deserialize.web3.PublicKey(
"BeRUj3h7BqkbdfFU7FBNYbodgf8GCHodzKvF9aVjNNfL"
),
tokenA: new deserialize.web3.PublicKey(
"GU7NS9xCwgNPiAdJ69iusFrRfawjDDPjeMBovhV1d4kn"
),
publicKey: new deserialize.web3.PublicKey(
"8PE7zNHVmn1zmFqNxPHpgjriDd8MNfTHWadPKenYDQX2"
),
amountIn: 0.0028,
dexId: "INVARIANT",
options: {
reduceToTwoHops: false, //set to true if you always want two hops
},
};
const response = await deserialize.swapTx(params);
console.log("Instructions:", response);
//sign and simulate the transaction
const connection = new deserialize.web3.Connection(
"https:///eclipse.lgns.net",
"confirmed"
);
const tx = response.transaction;
const serializedTx = Buffer.from(tx.serialize()).toString("base64");
console.log("serializedTx: ", serializedTx);
const { value } = await connection.simulateTransaction(tx);
console.log("value: ", value);
tx.sign([userKeyPair]);
const sign = await connection.sendTransaction(tx, { skipPreflight: false });
console.log("sign: ", sign);
})();
new SwapSDK(baseUrl?: string)
swapTx(params: SwapRequestParams): Promise<SwapTxResult>
Sends a swap request and returns a fully constructed, unsigned VersionedTransaction along with:
amountOut: Raw output amount.amountOutUi: Human-readable output amount.routePlan: An array of route steps (with tokens as PublicKey).lookupAccounts: Lookup accounts as PublicKey objects.signers: Signers as Keypair objects.swapIx(params: SwapRequestParams): Promise<SwapIxResult>
Sends a swap request and returns the underlying instruction groups and additional swap details:
instructionGroups: Groups of main and cleanup instructions (as TransactionInstruction objects).amountOut: Raw output amount.amountOutUi: Human-readable output amount.routePlan: An array of route steps (with tokens as PublicKey).lookupAccounts: Lookup accounts as PublicKey objects.signers: Top-level signers as base64-encoded strings.publicKey: User's public key (PublicKey).tokenA: Token A's address (PublicKey).tokenB: Token B's address (PublicKey).amountIn: Amount of token A to swap (number, in human-readable units).dexId: "INVARIANT" (string literal).options?: Optional routing options (RouteOptions).reduceToTwoHops: boolean — if set to true, limits the swap to two hops to avoid errors like TooManyAccountLocks.Both results include the output amounts, route plan, and lookup accounts; the key difference is that SwapTxResult returns a full transaction (as a VersionedTransaction), whereas SwapIxResult returns raw instruction groups.
This project is licensed under the MIT License.
Happy swapping!
---
FAQs
Swap SDK for the deserialize aggregator
The npm package @deserialize/swap-sdk receives a total of 27 weekly downloads. As such, @deserialize/swap-sdk popularity was classified as not popular.
We found that @deserialize/swap-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.