
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@gnosis.pm/cow-sdk
Advanced tools
⚠️⚠️ THE SDK IS IN Beta ⚠️⚠️ It is being currently develop and is a work in progress, also it's API is subjected to change. If you experience any problems, please open an issue in Github trying to describe your problem.
Install the SDK:
yarn add @gnosis.pm/cow-sdk
Instantiate the SDK:
import { CowSdk } from 'cow-sdk'
const chainId = 4 // Rinkeby
const cowSdk = new CowSdk(chainId)
The SDK will expose the CoW API operations (cowSdk.cowApi
) and some convenient method that will facilitate signing orders (cowSdk.signOrder
). Future version will provide easy access to The Graph data and some other convenient utils.
// i.e. Get last 5 orders for a given trader
const trades = await cowSdk.cowApi.getOrders({
owner: '0x00000000005ef87f8ca7014309ece7260bbcdaeb', // Trader
limit: 5,
offset: 0
})
console.log(trades)
Let's see a full example on how to submit an order to CowSwap.
⚠️ Before starting, the protocol requires you to approve the sell token before the order can be considered. For more details see https://docs.cow.fi/tutorials/how-to-submit-orders-via-the-api/1.-set-allowance-for-the-sell-token
In this example, we will:
import { Wallet } from 'ethers'
import { CowSdk, OrderKind } from 'cow-sdk'
// 1. Instantiate wallet and SDK
const mnemonic = 'fall dirt bread cactus...'
const wallet = Wallet.fromMnemonic(mnemonic)
const cowSdk = new CowSdk(4, { signer: wallet })
// 2. Get a price/fee quote from the API
// It will return the price and fee to "Sell 1 ETH for USDC"
const quoteResponse = await cowSdk.cowApi.getQuote({
kind: OrderKind.SELL, // Sell order (could also be BUY)
sellToken: '0xc778417e063141139fce010982780140aa0cd5ab', // WETH
buyToken: '0x4dbcdf9b62e891a7cec5a2568c3f4faf9e8abe2b', // USDC
amount: '1000000000000000000', // 1 WETH
userAddress: '0x1811be0994930fe9480eaede25165608b093ad7a', // Trader
validTo: 2524608000,
})
const { sellToken, buyToken, validTo, buyAmount, sellAmount, receiver, feeAmount } = quoteResponse.quote
const order = {
kind: OrderKind.SELL,
partiallyFillable: false, // Allow partial executions of an order (true would be for a "Fill or Kill" order, which is not yet supported but will be added soon)
sellToken,
buyToken,
validTo,
buyAmount,
sellAmount,
receiver,
feeAmount,
}
// 3. Sign the order using your wallet
const signedOrder = await cowSdk.signOrder(order)
// 4. Post the signed order to the API
const orderId = await cowSdk.cowApi.sendOrder({
order: { ...order, ...signedOrder },
owner: '0x1811be0994930fe9480eaede25165608b093ad7a',
})
// We can inspect the Order details in the CoW Protocol Explorer
console.log(`https://explorer.cow.fi/rinkeby/orders/${orderId}`)
yarn
yarn build
# Build in watch mode
yarn start
yarn test
FAQs
Unknown package
We found that @gnosis.pm/cow-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 18 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.