
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
@doist/twist-sdk
Advanced tools
This is the official TypeScript SDK for the Twist REST API.
npm install @doist/twist-sdk
An example of initializing the API client and fetching a user's information:
import { TwistApi } from '@doist/twist-sdk'
const api = new TwistApi('YOUR_API_TOKEN')
api.users.getSessionUser()
.then((user) => console.log(user))
.catch((error) => console.log(error))
For applications that need to access user data, use OAuth 2.0:
import { getAuthorizationUrl, getAuthToken, TwistApi } from '@doist/twist-sdk'
// Step 1: Generate authorization URL
const authUrl = getAuthorizationUrl(
'your-client-id',
['user:read', 'channels:read'],
'state-parameter',
'https://yourapp.com/callback'
)
// Step 2: Exchange authorization code for access token
const tokenResponse = await getAuthToken({
clientId: 'your-client-id',
clientSecret: 'your-client-secret',
code: 'authorization-code',
redirectUri: 'https://yourapp.com/callback'
})
// Step 3: Use the access token
const api = new TwistApi(tokenResponse.accessToken)
const user = await api.users.getSessionUser()
The SDK supports making multiple API calls in a single HTTP request using the /batch
endpoint. This can significantly improve performance when you need to fetch or update multiple resources.
Note: Batch requests are completely optional. If you only need to make a single API call, simply call the method normally without the { batch: true }
option.
To use batch requests:
{ batch: true }
as the last parameter to any API methodBatchRequestDescriptor
instead of executing the request immediatelyapi.batch()
to execute them together// Single requests (normal usage)
const user1 = await api.workspaceUsers.getUserById(123, 456)
const user2 = await api.workspaceUsers.getUserById(123, 789)
// Batch requests - executes in a single HTTP call
const results = await api.batch(
api.workspaceUsers.getUserById(123, 456, { batch: true }),
api.workspaceUsers.getUserById(123, 789, { batch: true })
)
console.log(results[0].data.name) // First user
console.log(results[1].data.name) // Second user
Each item in the batch response includes:
code
- HTTP status code for that specific request (e.g., 200, 404)headers
- Response headers as a key-value objectdata
- The parsed and validated response dataconst results = await api.batch(
api.channels.getChannel(123, { batch: true }),
api.channels.getChannel(456, { batch: true })
)
results.forEach((result) => {
if (result.code === 200) {
console.log('Success:', result.data.name)
} else {
console.error('Error:', result.code)
}
})
When all requests in a batch are GET requests, they are executed in parallel on the server for optimal performance. Mixed GET and POST requests are executed sequentially.
// These GET requests execute in parallel
const results = await api.batch(
api.workspaceUsers.getUserById(123, 456, { batch: true }),
api.channels.getChannel(789, { batch: true }),
api.threads.getThread(101112, { batch: true })
)
You can batch requests across different resource types:
const results = await api.batch(
api.workspaceUsers.getUserById(123, 456, { batch: true }),
api.channels.getChannels({ workspaceId: 123 }, { batch: true }),
api.conversations.getConversations({ workspaceId: 123 }, { batch: true })
)
const [user, channels, conversations] = results
// TypeScript maintains proper types for each result
console.log(user.data.name)
console.log(channels.data.length)
console.log(conversations.data.length)
Individual requests in a batch can fail independently. Always check the status code of each result:
const results = await api.batch(
api.channels.getChannel(123, { batch: true }),
api.channels.getChannel(999999, { batch: true }) // Non-existent channel
)
results.forEach((result, index) => {
if (result.code >= 200 && result.code < 300) {
console.log(`Request ${index} succeeded:`, result.data)
} else {
console.error(`Request ${index} failed with status ${result.code}`)
}
})
For detailed documentation, visit the Twist SDK Documentation.
For information about the Twist REST API, see the Twist API Documentation.
This project uses ts-node for local development and testing.
npm install
scratch.ts
in the src
folderts-node
(instructions for VSCode, WebStorm), or run it directly: npx ts-node ./src/scratch.ts
Example scratch.ts file:
import { TwistApi } from './twist-api'
const token = 'YOUR_API_TOKEN'
const api = new TwistApi(token)
api.workspaces.getWorkspaces()
.then((workspaces) => {
console.log(workspaces)
})
.catch((error) => console.error(error))
npm test
- Run testsnpm run test:watch
- Run tests in watch modenpm run test:coverage
- Run tests with coveragenpm run build
- Build the packagenpm run type-check
- Type check without buildingnpm run lint:check
- Check code stylenpm run format:check
- Check formattingThis package follows semantic versioning. Currently in alpha release (0.1.0-alpha.x).
A new version is published to the NPM Registry whenever a new release on GitHub is created. The workflow automatically detects prerelease versions (alpha, beta, rc) and publishes them with the appropriate tag.
To prepare a new release:
# For alpha releases
npm version prerelease --preid=alpha --no-git-tag-version
# For stable releases
npm version <major|minor|patch> --no-git-tag-version
Once the version in package.json
is updated, push the changes and create a GitHub release. The workflow will automatically publish to npm with the correct tag.
Any feedback, such as bugs, questions, comments, etc. can be reported as Issues in this repository, and will be handled by the Doist team.
We welcome contributions in the form of Pull requests in this repository.
FAQs
A TypeScript wrapper for the Twist REST API.
We found that @doist/twist-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.