
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@sima-prime/agent-sdk
Advanced tools
TypeScript client for SIMA's production agent protection purchase API.
Package: @sima-prime/agent-sdk
OpenAPI: https://sima-prime.com/openapi.json
API base: https://api.sima-prime.com
Core principle:
For bots and AI agents, the API is the product.
npm install @sima-prime/agent-sdk
pnpm add @sima-prime/agent-sdk
yarn add @sima-prime/agent-sdk
Aligned to OpenAPI x-sima-agent-protection-purchase-flow-path:
POST /agent/wallet/nonce
POST /agent/wallet/verify
POST /agent/protection/offer
POST /agent/protection/purchase
GET /agent/protection/certificates/{id}/payment-intent
→ caller sends SOL on-chain (outside SDK)
POST /agent/protection/certificates/{id}/confirm-payment
GET /agent/protection/certificates/{id}
All commercial amounts are asset-denominated (contract asset / SOL). There are no USD commercial fields.
import { SimaAgentClient } from "@sima-prime/agent-sdk";
const client = new SimaAgentClient();
const nonce = await client.requestWalletNonce("YOUR_WALLET_ADDRESS");
// Sign nonce.message with your wallet outside this SDK.
const auth = await client.verifyWalletSignature({
chain: "SOLANA",
walletAddress: "YOUR_WALLET_ADDRESS",
message: nonce.message,
signature: "YOUR_SIGNATURE",
});
client.setAccessToken(auth.accessToken);
const offer = await client.getProtectionOffer({
chain: "SOLANA",
walletAddress: "YOUR_WALLET_ADDRESS",
assetAddress: "YOUR_ASSET_ADDRESS",
assetSymbol: "EXAMPLE",
assetType: "TOKEN",
protectedAmount: "1000",
});
const purchase = await client.purchaseProtection({
...offer,
chain: "SOLANA",
walletAddress: "YOUR_WALLET_ADDRESS",
assetAddress: "YOUR_ASSET_ADDRESS",
assetType: "TOKEN",
protectedAmount: offer.protectedAmount,
offerId: offer.offerId,
protectionDecision: "PURCHASE_PROTECTION",
});
if (purchase.protectionDecision !== "PURCHASE_PROTECTION") {
throw new Error("Protection declined");
}
const intent = await client.getPurchasePaymentIntent(purchase.certificateId);
// Send intent.amountDue SOL to intent.destinationTreasuryWalletAddress
// with your wallet / bot runtime. Keep the on-chain signature.
const active = await client.confirmPurchasePayment(purchase.certificateId, {
paymentReference: intent.paymentReference,
transactionSignature: "YOUR_ON_CHAIN_SIGNATURE",
});
console.log(active.certificateNumber, active.certificateStatus);
| Method | Endpoint |
|---|---|
requestWalletNonce | POST /agent/wallet/nonce |
verifyWalletSignature | POST /agent/wallet/verify |
getProtectionOffer | POST /agent/protection/offer |
purchaseProtection | POST /agent/protection/purchase |
getPurchasePaymentIntent | GET /agent/protection/certificates/{id}/payment-intent |
confirmPurchasePayment | POST /agent/protection/certificates/{id}/confirm-payment |
getProtectionCertificate | GET /agent/protection/certificates/{id} |
Premium = 5% of protected amount
Coverage = 50% of protected amount
Deductible = 10% of protected amount
Maximum Net Payment = 40% of protected amount
| Concept | Duration |
|---|---|
| Quote Validity | 30 seconds |
| Payment Window | 30 seconds after acceptance |
| Protection Window | 5 minutes after premium payment |
| Certificate Lifetime | 24 hours from issuance |
| Claim Window | 24 hours from issuance |
| Historical Record | Permanent |
The SDK does not:
A certificate is purchased coverage and the right to submit a claim for investigation. Claim decisions and treasury payout remain separate steps.
Read-only discovery MCP (does not call the API):
npx @sima-prime/mcp-server
sima_get_quote_flow documents getProtectionOffer with protectedAmount (asset-denominated).
examples/basic-flow.ts
examples/purchase-flow.ts
Placeholders only: YOUR_WALLET_ADDRESS, YOUR_SIGNATURE, YOUR_ON_CHAIN_SIGNATURE, etc.
https://sima-prime.com/developers/public
https://sima-prime.com/openapi.json
https://sima-prime.com/llms.txt
https://sima-prime.com/ai-catalog.json
npm install
npm run build
This repository is the public SDK, examples, and discovery metadata.
Private core systems (treasury ops, claims investigation internals, production deployment) remain in the private SIMA monorepo.
FAQs
TypeScript SDK foundation for SIMA agent and bot integrations.
The npm package @sima-prime/agent-sdk receives a total of 1 weekly downloads. As such, @sima-prime/agent-sdk popularity was classified as not popular.
We found that @sima-prime/agent-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.