
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@ebot7/javascript-sdk
Advanced tools
ebot7 Javascript SDK. A thin client for developing and testing aspects of the ebot7 Application.
ebot7 Javascript SDK.
This is the ebot7 Javascript Software Development Kit (JS SDK) Package.
The JS SDK is a thin client for developing and testing aspects of the ebot7 Application.
It has been set up with automated unit tests and package publishing workflow using GitHub Actions CI/CD.
It uses npm, TypeScript Compiler, Jest, ESLint, Prettier and cspell. The production files include CommonJS, ES Modules, UMD version and TypeScript declaration files.
You need to have Node.js installed. Node includes npm as its default package manager.
Install dependencies with yarn:
yarn install
Make necessary changes in package.json (name, version, description, keywords, author, homepage and other URLs).
Write your code in src folder, and unit test in test folder, replacing the original files there.
Test all aspects of the code (Prettier, ESLint, and Jest) with:
yarn test
Optionally run individual tests using any or the below:
Prettier: yarn test:prettier
Spelling: yarn test:spelling
ESLint: yarn test:eslint
Unit Test: yarn test:unit
Build production (distribution) files in your build folder:
yarn build
It generates CommonJS (in build/main folder), ES Modules (in build/module folder).
Run:
npm link
npm link will create a symlink in the global folder, which may be {prefix}/lib/node_modules/@bot7/javascript-sdk or C:\Users<username>\AppData\Roaming\npm\node_modules@ebot7\javascript-sdk.
Create an empty folder elsewhere, you don't even need to npm init
(to generate package.json). Open the folder with VS Code, open a terminal and just run:
npm link @ebot7/javascript-sdk
This will create a symbolic link from globally-installed example-typescript-package to node_modules/ of the current folder.
You can then create a, for example, test-client.ts file with the content:
import { Client } from '@ebot7/javascript-sdk';
If you don't see any linting errors in VS Code, if you put your mouse cursor over Client
and see its type, then it's all good.
Whenever you want to uninstall the globally-installed package and remove the symlink in the global folder, run:
npm uninstall @ebot7/javascript-sdk -g
Create an npm account.
Log in:
npm adduser
And publish:
npm publish
This package is configured to use GitHub Actions CI/CD to automate both the npm and GitHub Packages publishing process. The following are what you have to do.
Follow npm's official instruction to create an npm token. Choose "Publish" from the website, or use npm token create
without argument with the CLI.
If you use 2FA, then make sure it's enabled for authorization only instead of authorization and publishing (Edit Profile -> Modify 2FA).
On the page of your newly created or existing GitHub repo, click Settings -> Secrets -> New repository secret, the Name should be NPM_TOKEN
and the Value should be your npm token.
The default configuration of this example package assumes you publish package with an scoped name to npm.
(You might have noticed secret.GITHUB_TOKEN
in .github/workflows/test.yml. You don't need to set up a secret named GITHUB_TOKEN
actually, it is automatically created)
Now everything is set. The example package has automated tests and upload (publishing) already set up with GitHub Actions:
git push
or a pull request is submitted on your master
or main
branch, the package is automatically tested against the desired OS and Node.js versions with GitHub Actions.npm version
/ yarn version
is useful to create tags."postversion": "git push --follow-tags"
to package.json file to push it automatically after npm
or yarn
version
. (for yarn version
only: because yarn version
doesn't check whether there are uncommitted changes, you can add "preversion": "git diff-index --quiet HEAD --"
to package.json)For npm registry: you can unpublish a version or the whole package but can never re-publish the same version under the same name.
If you want to modify the description / README on the npm package page, you have to publish a new version. You can modify the description on GitHub Packages without publishing.
scripts
in the file package.json)
scripts
in package.json for other predefined script commandsBtw, if you want to publish Python package, go to Example PyPI (Python Package Index) Package & Tutorial / Instruction / Workflow for 2021.
FAQs
ebot7 Javascript SDK. A thin client for developing and testing aspects of the ebot7 Application.
The npm package @ebot7/javascript-sdk receives a total of 0 weekly downloads. As such, @ebot7/javascript-sdk popularity was classified as not popular.
We found that @ebot7/javascript-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.