
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@keyban/sdk-base
Advanced tools
Keyban Javascript SDK provides core functionalities for the MPC wallet solution, supporting web and Node.js apps with TypeScript, custom storage, and Ethereum blockchain integration.
The Keyban JavaScript SDK provides the core functionality for Keyban's MPC wallet solution, simplifying the development of web and Node.js applications. It offers TypeScript-first APIs, client-share persistence hooks, network-specific helpers and GraphQL documents to integrate wallet features (balances, NFTs, transfers) into your app.
This README has been extended with a short API reference, GraphQL import hints, error handling guidance and a developer setup section to help integrators and contributors.
tsup.npm install @keyban/sdk-base
import { KeybanClient, KeybanNetwork } from "@keyban/sdk-base";
const client = new KeybanClient({
appId: "your-keyban-app-id",
network: KeybanNetwork.EthereumAnvil,
});
const account = await client.initialize();
console.log(account.address);
account.signMessage('...').account.estimateTransfer(to).account.transfer(to, value).account.transferERC20({ contractAddress, to, value }).account.transferNft({ contractAddress, to, tokenId, standard, value? }).See examples below for full snippets.
This is a short, high-level reference to the most commonly used types and functions. For the complete API please consult the generated docs or the TypeScript d.ts files in the package.
KeybanClient constructor:
new KeybanClient(config: { apiUrl?: string|URL; appId: string; clientShareProvider?: ClientShareProvider; network: KeybanNetwork; })KeybanClient.prototype.initialize(): Promise<KeybanAccount>
KeybanAccount (abstract) — common methods:
transfer(to: string, value: bigint, fees?: FeeDetails): Promise<string>transferERC20(params: TransferERC20Params): Promise<string>transferNft(params: TransferNftParams): Promise<string>estimateTransfer(to: string): Promise<FeesEstimation>estimateERC20Transfer(params: EstimateERC20TransferParams): Promise<FeesEstimation>estimateNftTransfer(params: EstimateNftTransferParams): Promise<FeesEstimation>signMessage(message: string): Promise<string | string[]>Balance / format:
type Balance = { raw: string | bigint; decimals?: number; symbol?: string; isNative?: boolean; isFees?: boolean; }formatBalance(client: KeybanClient, balance: Balance, token?: KeybanToken): stringClientShareProvider (custom storage):
interface ClientShareProvider {
get(key: string): Promise<string | null>;
set(key: string, clientShare: string): Promise<void | unknown>;
}
GraphQL exports (short list, imported from '@keyban/sdk-base/graphql'):
By default the SDK uses the built-in provider that persists client-share via Keyban's API. If you need to manage client shares yourself (for compliance, storage choice, or custom auth), implement ClientShareProvider:
Example:
class MyClientShareProvider implements ClientShareProvider {
async get(key: string): Promise<string | null> {
const res = await fetch(`/api/clientShare?key=${encodeURIComponent(key)}`);
if (!res.ok) return null;
return res.text();
}
async set(key: string, clientShare: string): Promise<void> {
const res = await fetch(`/api/clientShare`, {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: "Bearer ...",
},
body: JSON.stringify({ key, clientShare }),
});
if (!res.ok) throw new Error("failed to save client share");
}
}
Security recommendations:
We export ready-to-use GraphQL documents. Typical imports:
import {
walletBalanceDocument,
walletTokenBalancesDocument,
} from "@keyban/sdk-base/graphql";
const { data } = await client.apolloClient.query({
query: walletTokenBalancesDocument,
variables: { walletId: account.address, first: 20 },
});
Pagination:
first + cursor after pattern returned by the documents.The SDK exposes typed errors to help handling:
Example handling:
import { SdkError, SdkErrorTypes } from "@keyban/sdk-base";
try {
await account.transfer(to, value);
} catch (err) {
if (err instanceof SdkError) {
if (err.type === SdkErrorTypes.InsufficientFunds) {
// handle
} else {
console.error("SDK error:", err.message);
}
} else {
console.error("Unexpected error:", err);
}
}
Supported networks:
When switching networks be mindful of unit conversions (decimals) and fee formats.
Quick developer commands:
Local linking for app development:
npm pack / npm install ../path/to/packed.tgz to test local changes.pnpm -w install and workspace linking patterns as appropriate.tsup for building distributable bundles — follow package build scripts in monorepo.@keyban/sdk-base/graphql exports.FAQs
Keyban Javascript SDK provides core functionalities for the MPC wallet solution, supporting web and Node.js apps with TypeScript, custom storage, and Ethereum blockchain integration.
We found that @keyban/sdk-base demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.