
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@reach-sh/humble-sdk
Advanced tools
A Javascript library for interacting with the HumbleSwap DEx.
Documentation has moved here.
v2 introduces a few changes and adds new functionality, including staking pools. Some functions may have been renamed: review changes in our changelog, and view our documentation for additional info.
The fastest way is to use npm:
$. npm i -s @reach-sh/humble-sdk
To get started without NPM, you can clone and build the SDK from the repository.
# Clone the repository
$. git clone https://github.com/reach-sh/humble-sdk.git
# Enter the directory with the repo (replace with path to your repository clone)
$. cd path/to/humble-sdk
# and install dependencies (there aren't a lot)
$. npm install
# Build the SDK. Will output to a ./lib directory in the same folder as the
# package.json file. This takes seconds and doesn't output anything to your terminal.
$. npm run build
You will know it is complete when your (terminal's) typing prompt reappears.
Then, as a FINAL STEP, copy or move the new lib/ directory into your project. This will allow you to access it like any other JS module:
import { initHumbleSDK } from "path/to/lib";
import { subscribeToPoolStream, createReachAPI } from "@reach-sh/humble-sdk";
const stdlib = createReachAPI();
const acc = await stdlib.createAccount();
// Fetch existing streams and get notified when a new one is created
subscribeToPoolStream(acc, {
// Pool ID (and id of pool tokens) received from contract.
// Pool data has NOT been fetched yet.
onPoolReceived: (info) => {
const [poolAddr, tokenAId, tokenBId] = info;
// ... do something with data
},
// Pool and Token data has been received from network.
onPoolFetched: (result: FetchPoolTxnResult) => {
const { succeeded, poolAddress, data, message } = result;
if (succeeded) // ... do something with data
}
})
Note: Swapping does not use routing. Read the docs to learn how to fetch pools for DEx operations.
import { calculateTokenSwap, performSwap } from "@reach-sh/humble-sdk";
const pool = /* pool source */
// Calculate expected swap output
const { tokenAId, tokenBId } = pool;
const amountA = 100;
const swap = calculateTokenSwap({
pool,
swap: { amountA, tokenAId, tokenBId }
});
// Perform swap
const swapOpts = { poolAddress: pool.poolAddress, swap, pool };
const { data, message, succeeded } = await performSwap(acc, swapOpts);
// if (succeeded) data == { amountIn: string; amountOut: string }
The humble-sdk contains some helper scripts for running the SDK on a command line. See more here
FAQs
A Javascript library for interacting with the HumbleSwap DEx
The npm package @reach-sh/humble-sdk receives a total of 35 weekly downloads. As such, @reach-sh/humble-sdk popularity was classified as not popular.
We found that @reach-sh/humble-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.