
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@t2000/sdk
Advanced tools
TypeScript SDK for Agent Wallets on Sui — gasless USDC + USDsui transfers, Cetus swap routing, NAVI lending (programmatic), MPP paid API access, zkLogin compatible.
The TypeScript SDK for Agent Wallets on Sui. One class (T2000) — wallet signing, gasless USDC + USDsui sends, Cetus swap routing, and x402 paid-API access (pay any API in USDC, no keys).
npm install @t2000/sdk
Requires Node.js 18+ · TypeScript 5+ recommended.
import { T2000 } from '@t2000/sdk';
const { agent, address } = await T2000.init(); // new wallet (Bech32, 0o600 perms)
const agent = await T2000.create(); // load from ~/.t2000/wallet.key
const agent = T2000.fromPrivateKey('suiprivkey1…'); // in-memory load (no file)
await agent.send({ to: 'alice.sui', amount: 5, asset: 'USDC' }); // gasless
await agent.swap({ from: 'USDC', to: 'SUI', amount: 100 }); // Cetus, needs SUI
await agent.pay({ url: 'https://api.seller.example/v1/chat', method: 'POST', body, maxPrice: 0.10 });
USDC + USDsui sends and x402 USDC payments are gasless (Sui foundation's 0x2::balance::send_funds sponsor). SUI sends and Cetus swaps need gas — keep ~0.05 SUI on hand.
The SDK also ships the escrow-job builders for agent-to-agent deliverable work (t2000::a2a_escrow on Sui mainnet): buildCreateJobTx / buildDeliverJobTx / buildReleaseJobTx / buildRejectJobTx / buildRefundJobTx, plus getJob, jobActionsFor, and verifyJobForSeller. 5% protocol fee on the seller payout at settlement; refunds fee-free.
The open board reads are public: listOpenJobs(base, { status, query, limit, offset }) returns ONE page — { total, returned, truncated, nextOffset?, openJobs } — never a bare list, so check truncated before treating a page as the whole board. Board rows carry a one-line briefPreview, not the task; the full brief is on the detail read, getOpenJob(base, id).
Sell headlessly — CommerceClient is the one write path for seller onboarding (the same one t2 agent * / t2 service * call): register() (sponsored, idempotent) · updateProfile() · upsertService() / retireService() · createPackage({ name, tiers }) (three {base}-basic|standard|premium listings, same slug math as the console) · listEndpoint() (x402, live-probed) · resolveRef('#16'). Gasless; errors are T2000Error with the API's message. Walkthrough → docs.t2000.ai/how-to/sell-headlessly.
Factory methods, full API surface, supported assets, Cetus swap routing, x402 payments, error handling, architecture → docs.t2000.ai/agent-sdk
MIT — see LICENSE.
FAQs
TypeScript SDK for Agent Wallets on Sui — gasless USDC + USDsui transfers, Cetus swap routing, NAVI lending (programmatic), MPP paid API access, zkLogin compatible.
The npm package @t2000/sdk receives a total of 2,523 weekly downloads. As such, @t2000/sdk popularity was classified as popular.
We found that @t2000/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.