
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@spx-network/sdk
Advanced tools
Streaming payments for the Solana agent economy. Collapse millions of micropayments into single on-chain settlements.
npm install @spx/sdk
Add SPX payment verification to any Express API:
import express from "express";
import { spxMiddleware } from "@spx/sdk/server";
const app = express();
// Verify vouchers on every request — Ed25519 check, no RPC, microseconds
app.use("/api", spxMiddleware({
agentPublicKeys: {
// escrow pubkey → agent's Ed25519 public key
"EscrowPubkeyHere...": new Uint8Array([/* 32 bytes */]),
},
onVoucher: (voucher, amount) => {
console.log(`Earned ${amount} tokens`);
},
}));
app.get("/api/data", (req, res) => {
res.json({ result: "paid content" });
});
app.listen(3000);
Requests without a valid X-SPX-Voucher header get a 402 Payment Required response.
import { SpxClient } from "@spx/sdk/client";
import { PublicKey } from "@solana/web3.js";
const client = new SpxClient({
agentSecretKey: myAgentKeypair.secretKey, // Ed25519 keypair
escrowKey: new PublicKey("MyEscrowPDA..."),
escrowCreatedAt: 1700000000n, // from on-chain escrow account
});
// Sign a voucher (off-chain, instant, no tx)
const { header } = client.pay(
new PublicKey("ServicePubkey..."),
1000n // amount in token units
);
// Attach to any HTTP request
const response = await fetch("https://api.example.com/data", {
headers: { "X-SPX-Voucher": header },
});
Only the latest voucher per escrow matters. 1 million API calls = 1 settlement transaction.
Services collect vouchers and settle periodically:
import { buildSettleInstructions } from "@spx/sdk";
import { Connection, Transaction } from "@solana/web3.js";
const verifier = new SpxVerifier({ agentPublicKeys: { ... } });
// After accumulating vouchers...
const vouchers = verifier.getSettleableVouchers();
for (const voucher of vouchers) {
const [ed25519Ix, settleIx] = buildSettleInstructions({
voucher,
agentPublicKey, // 32 bytes
service: serviceKeypair.publicKey,
serviceTokenAccount,
escrow: voucher.escrowKey,
vault: escrowVault,
treasuryTokenAccount,
mint: usdcMint,
});
const tx = new Transaction().add(ed25519Ix, settleIx);
// sign and send...
}
signVoucher(params) → SpxVoucher — sign a voucher with agent keypairverifyVoucher(voucher, agentPublicKey) → boolean — local Ed25519 checkserializeVoucher(voucher) → string — base64 for HTTP headersdeserializeVoucher(encoded) → SpxVoucher — parse from HTTP headerbuildVoucherMessage(...) → Buffer — raw 110-byte messagenew SpxClient({ agentSecretKey, escrowKey, escrowCreatedAt }) — create clientSpxClient.fromChain({ connection, agentSecretKey, owner, label }) — create from on-chain stateclient.pay(serviceKey, amount) → { voucher, header } — sign and serializenew SpxVerifier({ agentPublicKeys }) — create verifierverifier.verify(headerValue) → VerifyResult — verify a voucherverifier.getSettleableVouchers() → SpxVoucher[] — latest per escrowspxMiddleware({ agentPublicKeys, onVoucher }) — Express middlewarefindEscrowPda(owner, label) → [PublicKey, bump]findSettlementPda(escrow, service) → [PublicKey, bump]findConfigPda() → [PublicKey, bump]buildEd25519Instruction(agentPublicKey, message, signature) → TransactionInstructionbuildSettleInstruction(params) → TransactionInstructionbuildSettleInstructions(params) → [TransactionInstruction, TransactionInstruction]SPX Program ID: 56xJw72Lc1yDC6QwV8xNhiU6dDgUT1E9Ybh1nSxD4QZW
Voucher format (110 bytes):
SPX_VOUCHER_V1 (14) | escrow (32) | created_at (8 i64 BE)
| service (32) | amount (8 u64 BE) | cumulative (8 u64 BE) | nonce (8 u64 BE)
MIT
FAQs
SPX Protocol SDK — streaming payments for the Solana agent economy
The npm package @spx-network/sdk receives a total of 5 weekly downloads. As such, @spx-network/sdk popularity was classified as not popular.
We found that @spx-network/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.