
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@fractalshq/token2022-wrapper
Advanced tools
Utilities and instruction builders for wrapping Token-2022 mints into SPL Token mints via the Token2022 Wrapper program.
Utilities and instruction builders for wrapping Token-2022 mints into SPL Token mints via the Token2022 Wrapper program.
npm install @fractalshq/token2022-wrapper bn.js @solana/web3.js @solana/spl-token
Build locally (isolate from repo):
cd packages/token2022-wrapper
rm -rf node_modules
npm i
npm run build
import { Connection, PublicKey, Transaction } from '@solana/web3.js';
import { buildWrap2022ToSplIx, getWrapperTokenMint } from '@fractalshq/token2022-wrapper';
const connection = new Connection('https://api.mainnet-beta.solana.com');
const token2022Mint = new PublicKey('...');
const owner = new PublicKey('...');
const { preIxs, ixs, wrapperMint } = await buildWrap2022ToSplIx({
connection,
token2022Mint,
owner,
amount: 1_000_000, // base units per token2022 decimals
createAtaIfMissing: true,
});
const tx = new Transaction();
(preIxs ?? []).forEach(ix => tx.add(ix));
ixs.forEach(ix => tx.add(ix));
console.log('Wrapper SPL mint:', wrapperMint.toBase58());
import { Connection, PublicKey, Transaction } from '@solana/web3.js';
import { buildWrap2022ToSplIx, getWrapperTokenMint } from '@fractalshq/token2022-wrapper';
const connection = new Connection('https://api.mainnet-beta.solana.com');
const token2022Mint = new PublicKey('...');
const owner = new PublicKey('...');
// Use a custom Token2022 wrapper program
const customProgramId = new PublicKey('YourCustomWrapperProgramIdHere');
const { preIxs, ixs, wrapperMint } = await buildWrap2022ToSplIx({
connection,
token2022Mint,
owner,
amount: 1_000_000, // base units per token2022 decimals
createAtaIfMissing: true,
programId: customProgramId, // Specify custom program ID
});
const tx = new Transaction();
(preIxs ?? []).forEach(ix => tx.add(ix));
ixs.forEach(ix => tx.add(ix));
console.log('Custom wrapper SPL mint:', wrapperMint.toBase58());
When using custom wrapping contracts (by specifying a programId), you are responsible for deploying and managing your own Token2022 Wrapper program. This library only provides the instruction builders and utilities to interact with any deployed Token2022 Wrapper program.
22WrapbNKwPSy3HcGQTTJpgv43tszbZdTEfBEWmGYX2V) is maintained and available for usebuildWrap2022ToSplIx(params) - Main wrapper function (accepts optional programId)createInitializeWrapperTokenInstruction(...) - Initialize wrapper (accepts optional programId)createDepositAndMintWrapperTokensInstruction(...) - Deposit and mint wrapper tokens (accepts optional programId)createWithdrawAndBurnWrapperTokensInstruction(...) - Withdraw and burn wrapper tokens (accepts optional programId)getWrapperTokenMint, getReserveAuthority, getReserveAuthorityTokenAccount) - accept optional programIdMIT
FAQs
Utilities and instruction builders for wrapping Token-2022 mints into SPL Token mints via the Token2022 Wrapper program.
We found that @fractalshq/token2022-wrapper demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.