
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@magicnewton/newton-protocol-sdk
Advanced tools
TypeScript SDK for the Newton Protocol — a decentralized policy engine for onchain transaction authorization, built as an EigenLayer AVS.
# Install dependencies
npm install @magicnewton/newton-protocol-sdk viem
The SDK provides several entry points:
// Public Client Actions
import { newtonPublicClientActions } from '@magicnewton/newton-protocol-sdk';
import { createPublicClient, webSocket } from 'viem';
import { sepolia } from 'viem/chains';
const newtonPublicClient = createPublicClient({
chain: sepolia,
transport: webSocket('wss://eth-sepolia.g.alchemy.com/v2/YOUR_KEY'),
}).extend(
newtonPublicClientActions({
policyContractAddress: '0xpolicyContractAddress',
}),
);
newtonPublicClient.getTaskStatus({ taskId: '0x...' });
// Wallet Client Actions
import { newtonWalletClientActions } from '@magicnewton/newton-protocol-sdk';
import { createWalletClient, webSocket } from 'viem';
import { sepolia } from 'viem/chains';
import { privateKeyToAccount } from 'viem/accounts';
const newtonWalletClient = createWalletClient({
chain: sepolia,
transport: webSocket('wss://alchemyWebsocketUrl'),
account: privateKeyToAccount('0xYOUR_PRIVATE_KEY'),
}).extend(newtonWalletClientActions({ apiKey: '<YOUR_API_KEY>' }));
newtonWalletClient.evaluateIntentDirect({...})
The SDK uses Rollup for bundling and supports both CommonJS and ES modules.
# Build the SDK
pnpm build
This will generate the following output in the dist/ directory:
dist/cjs/ - CommonJS modulesdist/es/ - ES modulesdist/types/ - TypeScript declaration filesFor development with watch mode:
# Build and watch for changes
pnpm build --watch
The project includes TypeScript configuration for type checking:
# Type check without building
npx tsc --noEmit
# Lint and auto-fix code
pnpm lint
The SDK includes a privacy module for client-side HPKE encryption used in privacy-preserving policy evaluation. Key exports:
createSecureEnvelope — HPKE encrypt plaintext into a SecureEnvelope (offline, zero network calls)getPrivacyPublicKey — fetch the gateway's X25519 HPKE public keyuploadEncryptedData — encrypt and upload data to the gateway in one calluploadSecureEnvelope — upload a pre-built SecureEnvelope to the gatewaygenerateSigningKeyPair — generate Ed25519 key pair for privacy signaturesstoreEncryptedSecrets — HPKE-encrypt plaintext secrets and upload them for PolicyDatasignPrivacyAuthorization — compute dual Ed25519 signatures for privacy-enabled tasksuploadConfidentialData — HPKE-encrypt and upload confidential data (blacklists, allowlists, etc.) for a ConfidentialDataRegistry domaingetConfidentialData — retrieve an HPKE-encrypted confidential data envelope by its data reference IDSee the SDK Reference for full API documentation.
The SDK includes an identity module for registering identity data and managing identity-to-PolicyClient links on the IdentityRegistry. Key exports:
registerIdentityData -- store identity data reference on-chain with gateway co-signatureidentityDomainHash -- compute the bytes32 domain identifier from a name (e.g., identityDomainHash("kyc"))linkIdentityAsSignerAndUser -- link identity when caller is both owner and userlinkIdentityAsSigner -- link identity as owner with counterparty signaturelinkIdentityAsUser -- link identity as user with counterparty signaturelinkIdentity -- link identity as 3rd party with dual signaturesunlinkIdentityAsSigner -- unlink identity as ownerunlinkIdentityAsUser -- unlink identity as userThe project uses Vitest for unit testing:
# Run tests
pnpm test
# Run tests in watch mode
pnpm test:watch
# Run tests with coverage
pnpm test:coverage
To test the locally built SDK from a different local project, you can use one of these methods:
In the Newton SDK project directory:
# Build the SDK first
pnpm build
# Create a global link
pnpm link --global
In your test project directory:
# Link to the globally linked SDK
pnpm link --global @magicnewton/newton-protocol-sdk
Import and use in your test project:
import { newtonWalletClientActions } from '@magicnewton/newton-protocol-sdk';
// Your test code here
When you make changes to the SDK:
# In the SDK directory, rebuild
pnpm build
# The changes will be immediately available in your linked test project
In your test project's package.json, add:
{
"dependencies": {
"@magicnewton/newton-protocol-sdk": "file:../path/to/newton-protocol-sdk"
}
}
Install dependencies:
pnpm install
Import and use normally:
import { newtonWalletClientActions } from '@magicnewton/newton-protocol-sdk';
If you prefer npm over pnpm:
In the Newton SDK project directory:
npm run build
npm link
In your test project directory:
npm link @magicnewton/newton-protocol-sdk
When you're done testing:
# In your test project directory
pnpm unlink @magicnewton/newton-protocol-sdk
# In the SDK directory
pnpm unlink --global
pnpm build (or pnpm build --watch for auto-rebuild)pnpm build) before linkingdist/types/The build process generates multiple module formats:
dist/cjs/ - For Node.js environmentsdist/es/ - For modern bundlers and browsersdist/types/ - For development and IDE supportpnpm installsrc/pnpm build (or pnpm build --watch for development)pnpm lint to check code qualitypnpm typecheck for TypeScript validationpnpm check:all to validate exports and bundle sizeIf you encounter build issues, try cleaning and rebuilding:
pnpm clean
pnpm install
pnpm build
Ensure TypeScript is properly configured:
npx tsc --noEmit
Auto-fix common linting problems:
pnpm lint
This repository uses automated releases with the auto tool for both production releases (master branch) and canary releases (pull requests).
pnpm lintpnpm typecheckpnpm buildpnpm check:allpnpm testApache License 2.0 - see LICENSE file for details.
FAQs
Official SDK for the Newton Protocol.
The npm package @magicnewton/newton-protocol-sdk receives a total of 225 weekly downloads. As such, @magicnewton/newton-protocol-sdk popularity was classified as not popular.
We found that @magicnewton/newton-protocol-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.