
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@ordercore/sdk
Advanced tools
OrderCore SDK — commerce API for AI agents: catalog, idempotent orders, checkout sessions. Zero dependencies, Node 18+.
Zero-dependency Node.js client for OrderCore — the commerce API for AI agents. Catalog, checkout sessions, and idempotent orders: agent retries never double-charge.
npm install @ordercore/sdk # Node 18+
OrderCore.sandbox() issues a fresh read-only key on the demo tenant and
returns a ready client — no signup, no key of your own:
import OrderCore from '@ordercore/sdk';
const oc = await OrderCore.sandbox(); // read-only demo key, issued for you
const { data } = await oc.products.list(); // live demo catalog
console.log(data.length, 'products');
The sandbox key is read-only (writes return 403), strictly rate limited, and
short lived. For a full read/write key: https://ordercore.ai/bootstrap.
import OrderCore from '@ordercore/sdk';
const oc = new OrderCore({ apiKey: process.env.ORDERCORE_API_KEY });
// Seed a demo catalog (idempotent), then create a retry-safe order.
const seed = await oc.onboarding.demoData();
const order = await oc.orders.create(
{ customer_id: seed.sample_customer_id, items: [{ sku_id: seed.sample_order_item.sku_id, quantity: 1 }] },
{ idempotencyKey: 'first-order-001' },
);
console.log(order.id, order.status);
orders.create / confirm / cancel always send an Idempotency-Key
(auto-generated if you don't pass one). Replaying a key returns the original
order; the same key with a different payload throws a 409 OrderCoreError
with error: "conflict" (the thrown error's .code is populated from that
error field) instead of silently double-ordering.account.{auth,status,usage,readiness} · products.{list,get,create,update,delete} ·
skus.get · inventory.{list,adjust,reserve,release} · prices.list ·
orders.{create,list,get,confirm,cancel} · onboarding.demoData ·
webhooks.{listEndpoints,createEndpoint,deleteEndpoint} ·
checkout.{createSession,updateSession,completeSession} ·
request(method, path, opts) for anything else.
Errors are OrderCoreError with status, code, body, request.
MIT © Cloudpeakify s.r.o.
FAQs
OrderCore SDK — commerce API for AI agents: catalog, idempotent orders, checkout sessions. Zero dependencies, Node 18+.
We found that @ordercore/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.