
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@offcoin/sdk
Advanced tools
TypeScript/JavaScript SDK for the Offcoin API. Manage members, tokens, XP, achievements, and leaderboards.
npm install @offcoin/sdk
# or
pnpm add @offcoin/sdk
# or
yarn add @offcoin/sdk
import { OffcoinClient } from '@offcoin/sdk';
const offcoin = new OffcoinClient({
clientId: 'your_client_id',
clientSecret: 'your_client_secret'
});
// List all members
const members = await offcoin.members.list();
// Create a member
const newMember = await offcoin.members.create({
name: 'John Doe',
aliases: ['discord:123456', 'github:johndoe']
});
// Add tokens
const result = await offcoin.members.addTokens('discord:123456', 100, 'Welcome bonus');
console.log(`New balance: ${result.newBalance}`);
// List all members
const members = await offcoin.members.list();
// Create a member
const member = await offcoin.members.create({
name: 'John Doe',
avatarUrl: 'https://example.com/avatar.png', // optional
aliases: ['discord:123456', 'github:johndoe'] // optional
});
// Get a member by alias
const member = await offcoin.members.get('discord:123456');
// Update a member
const updated = await offcoin.members.update('discord:123456', {
name: 'Jane Doe',
avatarUrl: null // remove avatar
});
// Get token balance
const balance = await offcoin.members.getBalance('discord:123456');
console.log(`Balance: ${balance.balance}`);
// Get XP and level
const xp = await offcoin.members.getXp('discord:123456');
console.log(`XP: ${xp.xp}, Level: ${xp.level}`);
// Add tokens
const result = await offcoin.members.addTokens('discord:123456', 100, 'Purchase reward');
// Subtract tokens
const result = await offcoin.members.subtractTokens('discord:123456', 50, 'Item purchase');
// Add XP
const result = await offcoin.members.addXp('discord:123456', 25);
// List all achievements
const achievements = await offcoin.achievements.list();
// Unlock an achievement for a member
const result = await offcoin.achievements.unlock('achievement-id', 'discord:123456');
console.log(`Unlocked: ${result.achievementName}`);
console.log(`Cascading achievements: ${result.cascadingAchievementsGranted}`);
// Get leaderboard (default: sorted by XP, limit 50)
const leaderboard = await offcoin.leaderboard.get();
// Get top 10 by tokens
const tokenLeaderboard = await offcoin.leaderboard.get({
sort: 'tokens',
limit: 10
});
// Get top 25 by level
const levelLeaderboard = await offcoin.leaderboard.get({
sort: 'level',
limit: 25
});
// List all purchasable permissions
const permissions = await offcoin.permissions.list();
// List permissions with ownership info for a specific member
const permissions = await offcoin.permissions.list({ alias: 'discord:123456' });
// Returns permissions with `owned` and `canPurchase` fields
// Purchase a permission for a member
const result = await offcoin.permissions.purchase('discord:123456', 'vip_access');
console.log(`Purchased ${result.permissionName} for ${result.tokenPrice} tokens`);
console.log(`New balance: ${result.newBalance}`);
The SDK throws typed errors for different scenarios:
import {
OffcoinClient,
AuthenticationError,
NotFoundError,
ValidationError
} from '@offcoin/sdk';
try {
await offcoin.members.get('unknown-alias');
} catch (error) {
if (error instanceof AuthenticationError) {
console.error('Invalid credentials');
} else if (error instanceof NotFoundError) {
console.error('Member not found');
} else if (error instanceof ValidationError) {
console.error('Validation failed:', error.message);
}
}
| Error Class | Code | Description |
|---|---|---|
AuthenticationError | UNAUTHORIZED | Invalid client_id or client_secret |
ForbiddenError | FORBIDDEN | Not authorized for this action |
NotFoundError | NOT_FOUND | Resource not found |
ValidationError | VALIDATION_ERROR | Invalid input data |
BadRequestError | BAD_REQUEST | Malformed request |
InternalError | INTERNAL_ERROR | Server error |
OffcoinError | Various | Base error class |
All types are exported for use in your application:
import type {
Member,
MemberBalance,
MemberXp,
Achievement,
LeaderboardEntry,
TokenOperationResult,
XpOperationResult,
UnlockResult,
Permission,
PurchasePermissionResult
} from '@offcoin/sdk';
The SDK uses Basic Authentication with your API credentials. You can find your clientId and clientSecret in the Offcoin admin dashboard under Settings > API Access.
const offcoin = new OffcoinClient({
clientId: process.env.OFFCOIN_CLIENT_ID!,
clientSecret: process.env.OFFCOIN_CLIENT_SECRET!
});
MIT
FAQs
TypeScript/JavaScript SDK for the Offcoin API
The npm package @offcoin/sdk receives a total of 0 weekly downloads. As such, @offcoin/sdk popularity was classified as not popular.
We found that @offcoin/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.