
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@eppo/js-client-sdk-common
Advanced tools
Common library for Eppo JavaScript SDKs (web, react native, and node)
Refer to our SDK documentation for how to install and use the SDK.
To set up the package for local development, run make prepare
after cloning the repository
Details:
/.../node_modules/@eppo/js-client-sdk-common/node_modules/uuid/dist/esm-browser/index.js:1
({"Object.<anonymous>":function(module,exports,require,__dirname,__filename,jest){export { default as v1 } from './v1.js';
^^^^^^
SyntaxError: Unexpected token 'export'
Add the following line to your jest.config.js
file:
transformIgnorePatterns: ['<rootDir>/node_modules/(?!(@eppo|uuid)/)'],
It may be useful to install the local version of this package as you develop the client SDK or Node SDK. This can be done in two steps:
make prepare
yarn add --force file:../js-client-sdk-common
(this assumes both repositories were cloned into the same directory)When publishing releases, the following rules apply:
Standard Release:
vX.Y.Z
(e.g., v4.3.5
)latest
tagPre-release:
vX.Y.Z-label.N
(e.g., v4.3.5-alpha.1
)alpha.1
)Note: The release will not be published if:
You can generate a bootstrap configuration string from either the command line or programmatically via the ConfigurationWireHelper class.
The tool allows you to specify the target SDK this configuration will be used on. It is important to correctly specify the intended SDK, as this determines whether the configuration is obfuscated (for client SDKs) or not (for server SDKs).
Install as a project dependency:
# Install as a dependency
npm install --save-dev @eppo/js-client-sdk-common
# or, with yarn
yarn add --dev @eppo/js-client-sdk-common
Common usage examples:
# Basic usage
yarn bootstrap-config --key <sdkKey> --output bootstrap-config.json
# With custom SDK name (default is 'js-client-sdk')
yarn bootstrap-config --key <sdkKey> --sdk android
# With custom base URL
yarn bootstrap-config --key <sdkKey> --base-url https://api.custom-domain.com
# Output configuration to stdout
yarn bootstrap-config --key <sdkKey>
# Show help
yarn bootstrap-config --help
The tool accepts the following arguments:
--key, -k
: SDK key (required, can also be set via EPPO_SDK_KEY environment variable)--sdk
: Target SDK name (default: 'js-client-sdk')--base-url
: Custom base URL for the API--output, -o
: Output file path (if not specified, outputs to console)--help, -h
: Show helpimport { ConfigurationHelper } from '@eppo/js-client-sdk-common';
async function getBootstrapConfig() {
// Initialize the helper
const helper = ConfigurationHelper.build(
'your-sdk-key',
{
sdkName: 'android', // optional: target SDK name (default: 'js-client-sdk')
baseUrl: 'https://api.custom-domain.com', // optional: custom base URL
});
// Fetch the configuration
const config = await helper.fetchConfiguration();
const configString = config.toString();
// You are responsible to transport this string to the client
const clientInitialData = {eppoConfig: eppoConfigString};
// Client-side
const client = getInstance();
const initialConfig = configurationFromString(clientInitialData.eppoConfig);
client.setInitialConfig(configurationFromString(configString));
}
The tool will output a JSON string containing the configuration wire format that can be used to bootstrap Eppo SDKs.
FAQs
Common library for Eppo JavaScript SDKs (web, react native, and node)
The npm package @eppo/js-client-sdk-common receives a total of 34,062 weekly downloads. As such, @eppo/js-client-sdk-common popularity was classified as popular.
We found that @eppo/js-client-sdk-common demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.