
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@shipeasy/sdk
Advanced tools
Shipeasy SDK — feature gates, runtime configs, experiments, and metrics for the Shipeasy hosted service.
The Shipeasy SDK for feature flags, dynamic configs, kill switches, A/B experiments, metric tracking, and SSR/i18n — for Node, Next.js, and Cloudflare Workers. Server-key only on the server; the browser uses its own client key.
📚 Full documentation: https://shipeasy-ai.github.io/sdk/ — also browsable under
docs/. This README is generated from those docs.
This SDK ships an installable agent skill — a copy-paste-ready guide to
configure() + new Client(user), testing, experiments, error reporting, and
more, with links the agent can pull for deeper docs:
docs/skill/SKILL.md · raw:
https://shipeasy-ai.github.io/sdk/skill/SKILL.mdnpx shipeasy-skill install → .claude/skills/shipeasy-typescript/SKILL.md
(or via the Shipeasy CLI: shipeasy docs skill --sdk typescript --install)Humans: you can copy that skill straight into your own project's agent skills
directory (e.g. .claude/skills/shipeasy-typescript/SKILL.md) so your coding agent
always uses the correct Shipeasy patterns. Every doc page and snippet is also
fetchable by URL — start from the manifest at https://shipeasy-ai.github.io/sdk/manifest.json.
npm install @shipeasy/sdk
# or
pnpm add @shipeasy/sdk
# or
yarn add @shipeasy/sdk
Per-framework setup (Next.js / Express / Cloudflare Workers) and the anon-id middleware are on the Installation page.
configure() once, then new Client(user) per requestimport { configure, Client } from "@shipeasy/sdk/server"; // or /client
configure({ apiKey: process.env.SHIPEASY_SERVER_KEY!,
attributes: (u: MyUser) => ({ user_id: u.id, plan: u.plan }) });
const flags = new Client(currentUser);
if (flags.getFlag("new_checkout")) { /* ship it */ }
Constructing new Client(user) before configure() throws.
| Page | What |
|---|---|
| Overview | The configure() + new Client(user) model. |
| Installation | Install, frameworks (Next / Express / Workers), configure() wiring. |
| Configuration | Keys, attributes, one-shot vs poll, every option. |
| Feature flags | getFlag, getFlagDetail, defaults. |
| Dynamic configs | getConfig, typed decode, defaults. |
| Kill switches | getKillswitch, named switches. |
| Experiments | getExperiment, logExposure, track. |
| Internationalization | SSR bootstrap + i18n loader tags. |
| Error reporting | see() structured error reporting. |
| Testing | configureForTesting / configureForOffline, overrides. |
| OpenFeature | ShipeasyProvider (OpenFeature server provider). |
| react native devtools | The SDK ships a shake-to-open devtools overlay for React Native / Expo apps at feature… |
| browser devtools | The in-browser devtools overlay is delivered as a hosted script, not as an npm dependen… |
| Advanced | Anon-id middleware, private attributes, sticky bucketing, SSR. |
Copy-paste snippets live under docs/snippets/
(release · metrics · i18n · ops); an installable agent skill is at
docs/skill/SKILL.md.
For unit tests, swap the live configure() for configureForTesting() — a drop-in sibling with no network, ever (no SDK key required). It replaces the active configuration with a network-free engine, seeds the values your code should see, and is read through the ordinary new Client(user). In this mode the rules never fetch, track() is a no-op, assign() logs no exposure, and telemetry is off — your tests never touch the network.
import { configureForTesting, Client, clearOverrides } from "@shipeasy/sdk/server"; // or /client
// Seed everything the code under test should see (no key, no network):
configureForTesting({
flags: { new_checkout: true },
configs: { upload_limits: { max_uploads: 50 } },
});
const flags = new Client({ user_id: "u_1" }); // construct once per callsite
flags.getFlag("new_checkout"); // true
flags.getConfig("upload_limits"); // { max_uploads: 50 }
clearOverrides(); // reset every seeded override back to the empty-blob default
More — the on-the-spot override helpers and a working example snapshot file — on the Testing page.
See LICENSE. Evaluation is tested against the cross-language MurmurHash3 vectors in Rollouts & bucketing.
FAQs
Shipeasy SDK — feature gates, runtime configs, experiments, and metrics for the Shipeasy hosted service.
The npm package @shipeasy/sdk receives a total of 265 weekly downloads. As such, @shipeasy/sdk popularity was classified as not popular.
We found that @shipeasy/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.