
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@fluxfi/pas
Advanced tools
TypeScript SDK for the Permissioned Assets Standard (PAS) on Sui.
PAS lets asset issuers define transfer policies that are enforced on-chain. The SDK handles policy resolution, account derivation, and transaction building so callers work with a simple intent-based API.
npm install @fluxfi/pas
The PAS client plugs into any Sui client via the $extend pattern:
import { SuiGrpcClient } from '@fluxfi/sui/grpc';
import { pas } from '@fluxfi/pas';
const client = new SuiGrpcClient({ network: 'testnet' }).$extend(pas());
The client auto-selects the correct on-chain package config for the connected network (mainnet or
testnet). For custom deployments (e.g. during localnet / CI testing) you can pass a packageConfig
explicitly:
const client = new SuiGrpcClient({ network: 'testnet' }).$extend(
pas({
packageConfig: {
packageId: '0x...',
namespaceId: '0x...',
},
}),
);
Every PAS user has a deterministic Account address derived from their wallet address. You can derive it locally — no network call needed — and then use regular Sui queries against it:
const accountAddress = client.pas.deriveAccountAddress(ownerAddress);
Once you have the account address, use the standard core client to query balances, objects, or any other on-chain state:
const DEMO_USD = '0xabc...::demo_usd::DEMO_USD';
const [walletBalance, accountBalance] = await Promise.all([
client.core.getBalance({ owner: ownerAddress, coinType: DEMO_USD }),
client.core.getBalance({ owner: accountAddress, coinType: DEMO_USD }),
]);
Other derivation helpers are available for policies and templates:
const policyAddress = client.pas.derivePolicyAddress(assetType);
const templateRegistryAddress = client.pas.deriveTemplateRegistryAddress();
Transactions use an intent-based API. You add intents to a Transaction and the SDK resolves them
at build time — fetching policies, approval templates, and creating accounts as needed.
import { Transaction } from '@fluxfi/sui/transactions';
const DEMO_USD = '0xabc...::demo_usd::DEMO_USD';
const tx = new Transaction();
tx.add(
client.pas.call.sendBalance({
from: senderAddress, // The sender address (NOT the account address)
to: recipientAddress, // the recipient wallet address. NOT the account address.
amount: 1_000_000,
assetType: DEMO_USD,
}),
);
// .. sign and execute
Under the hood, sendBalance will:
Policy for the asset type and resolve the required approval template
commands.@fluxfi/pas on npmFAQs
Permissioned Assets Standard SDK
The npm package @fluxfi/pas receives a total of 2 weekly downloads. As such, @fluxfi/pas popularity was classified as not popular.
We found that @fluxfi/pas demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.