
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@furlpay/auto-invest
Advanced tools
Automated dollar-cost averaging (DCA) for FurlPay — schedule recurring stablecoin-funded stock/ETF buys. Zero runtime dependencies.
Automated dollar-cost averaging (DCA) for FurlPay — "buy $10 of VOO every Monday with USDC." Schedule recurring, stablecoin-funded stock/ETF/crypto buys; a runner decides what's due and places the orders.
fetch, Node 18+).Maintained by FurlPay · MIT licensed.
npm i @furlpay/auto-invest
import { AutoInvest } from "@furlpay/auto-invest";
const ai = new AutoInvest({ apiKey: process.env.FURLPAY_API_KEY }); // omit key → simulate
ai.add({ symbol: "VOO", amount: 10, frequency: "weekly", dayOfWeek: 1 }); // Mondays
ai.add({ symbol: "BTC", amount: 25, frequency: "monthly", dayOfMonth: 1 }); // 1st of month
ai.add({ symbol: "AAPL", amount: 5, frequency: "daily" }); // every day
// Run this on a cron (e.g. hourly). It buys everything currently due.
const results = await ai.runDue();
// [{ scheduleId, symbol, amount, currency, status, orderId?, simulated?, ranAt }]
Each due schedule places a fractional market buy for its notional via
POST /investing/orders, funded in the schedule's currency (default USDC), and
records lastRun so it advances to the next slot.
| Frequency | Fires on | Options (UTC) |
|---|---|---|
daily | every day at hour | hour (0–23, default 14) |
weekly | dayOfWeek at hour | dayOfWeek (0=Sun…6=Sat, default 1), hour |
monthly | dayOfMonth at hour | dayOfMonth (1–28, default 1), hour |
The pure helpers are exported if you want to compute times yourself:
import { isDue, nextRun } from "@furlpay/auto-invest";
nextRun(schedule, new Date()); // next UTC fire time
isDue(schedule, new Date()); // should it run now?
| Method | Purpose |
|---|---|
ai.add(input) | Create a schedule (validates amount/day ranges) → Schedule |
ai.list() / ai.get(id) | Read schedules |
ai.pause(id) / ai.resume(id) / ai.remove(id) | Toggle / delete |
ai.nextRunAt(id) | Next UTC fire time for a schedule |
ai.due(now?) | Schedules due at now |
ai.runDue(now?) | Buy everything due; records lastRun → OrderResult[] |
ai.runNow(id, now?) | Force one schedule to buy now (ignores due check) |
ai.live | true when an API key is set (else orders simulate) |
Seed from your store and persist after each tick:
const ai = new AutoInvest({ apiKey, schedules: await db.loadSchedules() });
await ai.runDue();
await db.saveSchedules(ai.list()); // persists updated lastRun
npm run example
FURLPAY_API_KEY=fp_live_sk_... npm run example
npm test # tsc build + node --test (demo mode, no network)
The suite pins the scheduling math (daily/weekly/monthly nextRun, isDue
catch-up and no-double-fire), input validation, simulated runs recording
lastRun, and the live path (correct POST body to /investing/orders, plus
failed orders captured rather than thrown).
This library orchestrates FurlPay's investing API — it doesn't custody funds or execute trades itself; brokerage (via Alpaca) and settlement happen in the FurlPay API. Point it at your own FurlPay account and it invests on your behalf.
MIT
FAQs
Automated dollar-cost averaging (DCA) for FurlPay — schedule recurring stablecoin-funded stock/ETF buys. Zero runtime dependencies.
We found that @furlpay/auto-invest demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.