
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@hashgraph/sdk
Advanced tools
The JavaScript SDK for interacting with a Hiero based network
[!NOTE]
The project has been transfered from the https://github.com/hashgraph org and therefore the namespace is at several locations still based onhashgraphandhedera. We are working activly on migration the namespace fully to hiero.
NOTE: v1 of the SDK is deprecated and support will be discontinued after October 2021. Please install the latest version 2.x or migrate from v1 to the latest 2.x version. You can reference the migration documentation.
# with NPM
$ npm install --save @hiero-ledger/sdk
# with Yarn
$ yarn add @hiero-ledger/sdk
# with PNPM
$ pnpm add @hiero-ledger/sdk
The SDK is also available as a UMD (Universal Module Definition) build, which can be loaded directly in the browser from popular CDNs:
<script src="https://unpkg.com/@hiero-ledger/sdk@2.70.0/dist/umd.js"></script>
When using the UMD build in the browser, the SDK will be available as a global variable sdk. A minified version is also available at dist/umd.min.js.
# with npm
$ npm install -g @go-task/cli
# with homebrew
$ brew install go-task
# with npm
$ npm install -g pnpm
# with homebrew
$ brew install pnpm
After downloading the repo run:
task install
task build to build the SDK
The Hiero JavaScript SDK provides comprehensive support for React Native environments, including Expo. To ensure seamless integration, follow the guidelines based on your Expo version:
✅ Hiero Javascript SDK Version 2.60 and Above
For projects using SDK version 2.60 and above, Expo SDK version 51+ is supported, the SDK requires the react-native-get-random-values package in order to work.
To install it, run:
npm install react-native-get-random-values
After installation, the native dependency must be linked for the respective platforms:
🔗 Linking for Native Platforms
cd ios && pod install
Then, rebuild the iOS project.
⚠️ ✅ Hiero Javascript SDK Version 2.59 and Below For projects using SDK version 2.59 and below, Expo SDK Version 49 and below is supported, keep in mind that the SDK uses some functionalities provided from ethers/ethersproject and there is an issue using parts of ethers.js in this environment. A shims package has to be installed and imported before importing the SDK in your project.
npm install @ethersproject/shims
Import it before importing the SDK as shown below:
import '@ethersproject/shims';
import {
Client,
PrivateKey
AccountBalance,
} from "@hiero-ledger/sdk";
...
The Hiero JavaScript SDK does not currently support the following:
See examples.
Every example can be executed using the following command from the root directory: node examples/[name-of-example].js.
Note: Before running any examples, ensure you have:
task build in the root directory.pnpm install in the examples directoryFor detailed information on configuring the SDK, including environment variables and client settings, please refer to the CONFIGURATION.md file.
OPERATOR_ID and OPERATOR_KEY are fields populated from accounts created by the local nodeHEDERA_NETWORK="local-node"task test:integration:nodetask test:unitWhether you’re fixing bugs, enhancing features, or improving documentation, your contributions are important — let’s build something great together! Please read our contributing guide to see how you can get involved.
Hiero uses the Linux Foundation Decentralised Trust Code of Conduct.
FAQs
Hiero SDK
The npm package @hashgraph/sdk receives a total of 40,690 weekly downloads. As such, @hashgraph/sdk popularity was classified as popular.
We found that @hashgraph/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 15 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.