
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@furlpay/account-kit
Advanced tools
Furlpay smart-contract SDK — Safe/ERC-4337 deployment, paymaster & escrow bindings
Furlpay smart-contract SDK — deploy Safe smart accounts from passkeys, configure gas sponsorship, and manage time-locked pre-authorization escrows.
The on-chain layer behind Furlpay wallets, exposed programmatically:
A built-in mock provider (mock: true, the default) exercises the full lifecycle with no chain, RPC, or funds — ideal for tests and CI.
npm install @furlpay/account-kit
import { AccountKit } from "@furlpay/account-kit";
const kit = new AccountKit({ chain: "base" }); // mock mode by default
// 1. Deploy a Safe controlled by a device passkey
const safe = await kit.deploySafe([
{ credentialId: "cred_1", publicKey: "0x04ab…" },
]);
// 2. Sponsor its gas
await kit.configurePaymaster(safe.address, { mode: "sponsor" });
// …or bill gas in USDC:
await kit.configurePaymaster(safe.address, { mode: "erc20", feeToken: "USDC" });
// 3. Pre-authorize, then capture (or release) like a card auth
const hold = await kit.escrow.create(safe.address, merchantAddress, 120);
await kit.escrow.capture(hold, 87.5); // capture ≤ authorized amount
// await kit.escrow.release(hold); // or release the hold
Escrow holds are the primitive for bounded agent spending: fund a hold an agent can draw against, capped and expiring, revocable by the owner. See the agent-allowances issue and the spend-mandates RFC.
ethereum · polygon · base (default) · arbitrum · gnosis
Pass mock: false with rpcUrl and bundlerUrl to submit real UserOperations through your bundler.
Report vulnerabilities to hello@furlpay.com — please don't open public issues.
MIT
FAQs
Furlpay smart-contract SDK — Safe/ERC-4337 deployment, paymaster & escrow bindings
The npm package @furlpay/account-kit receives a total of 13 weekly downloads. As such, @furlpay/account-kit popularity was classified as not popular.
We found that @furlpay/account-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.