
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@paraport/core
Advanced tools
The @paraport/core package provides the foundational functionality for the ParaPort SDK, enabling seamless cross-chain token movement within the Polkadot/Kusama ecosystem. It serves as the backbone for the automated token movement feature, which automatically handles the process of ensuring users have sufficient funds on destination chains for transactions.
This package can be used directly for programmatic control of cross-chain transfers or as the foundation for UI integrations through the @paraport/sdk package.
The core package is structured around several key components:
const sdk = new ParaPortSDK({
getSigner: () => yourPolkadotSigner, // Required
logLevel: 'INFO', // Optional
bridgeProtocols: ['XCM'], // Optional
chains: customChainConfigurations // Optional
});
await sdk.initialize();
// Create a teleport session
const session = await sdk.initSession({
chain: 'AssetHubPolkadot', // Polkadot, Kusama, AssetHubPolkadot, AssetHubKusama, Hydration
asset: 'DOT',
amount: '10000000000', // 1 DOT (10^10 planck)
address: 'yourPolkadotAddress'
});
// Subscribe to session events
sdk.onSession('session:updated', (payload) => {
console.log('Session state changed:', payload.status);
});
// Subscribe to teleport events
sdk.onTeleport('teleport:completed', (payload) => {
console.log('Teleport completed with hash:', payload.txHash);
});
// Execute when ready
await sdk.executeSession(session.id);
// Retry Session
sdk.retrySession(session.id)
session:created: New token movement session createdsession:updated: Session state changessession:deleted: Session removedsession:completed: Session successfully completedsession:failed: Session failedmovement:started: Token movement transaction beginsmovement:updated: Token movement status changesmovement:completed: Token movement successfully completed@paraport/static: Static data about chains and assetspolkadot-api: High-performance Substrate/Polkadot API used for network interactionspnpm add @paraport/core polkadot-api
ParaPort Core declares polkadot-api as a peer dependency. Install it alongside the package:
pnpm add polkadot-api
The automated token movement feature simplifies cross-chain transfers by:
MIT
FAQs
Core functionality for ParaPort SDK
We found that @paraport/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.