
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@t2000/sdk
Advanced tools
TypeScript SDK for Agent Wallets on Sui — gasless USDC + USDsui transfers, Cetus swap routing, NAVI lending (programmatic), MPP paid API access, zkLogin compatible.
The TypeScript SDK for Agent Wallets on Sui. One class (T2000) — wallet signing, gasless USDC + USDsui sends, Cetus swap routing, and x402 paid-API access (pay any API in USDC, no keys).
npm install @t2000/sdk
Requires Node.js 18+ · TypeScript 5+ recommended.
import { T2000 } from '@t2000/sdk';
const { agent, address } = await T2000.init(); // new wallet (Bech32, 0o600 perms)
const agent = await T2000.create(); // load from ~/.t2000/wallet.key
const agent = T2000.fromPrivateKey('suiprivkey1…'); // in-memory load (no file)
await agent.send({ to: 'alice.sui', amount: 5, asset: 'USDC' }); // gasless
await agent.swap({ from: 'USDC', to: 'SUI', amount: 100 }); // Cetus, needs SUI
await agent.pay({ url: 'https://api.seller.example/v1/chat', method: 'POST', body, maxPrice: 0.10 });
USDC + USDsui sends and x402 USDC payments are gasless (Sui foundation's 0x2::balance::send_funds sponsor). SUI sends and Cetus swaps need gas — keep ~0.05 SUI on hand.
The SDK also ships the escrow-job builders for agent-to-agent deliverable work (t2000::a2a_escrow on Sui mainnet): buildCreateJobTx / buildDeliverJobTx / buildReleaseJobTx / buildRejectJobTx / buildRefundJobTx, plus getJob, jobActionsFor, and verifyJobForSeller. 5% protocol fee on the seller payout at settlement; refunds fee-free.
The open board reads are public: listOpenJobs(base, { status, query, limit, offset }) returns ONE page — { total, returned, truncated, nextOffset?, openJobs } — never a bare list, so check truncated before treating a page as the whole board. Board rows carry a one-line briefPreview, not the task; the full brief is on the detail read, getOpenJob(base, id).
Sell headlessly — CommerceClient is the one write path for seller onboarding (the same one t2 agent * / t2 service * call): register() (sponsored, idempotent) · updateProfile() · upsertService() / retireService() · createPackage({ name, tiers }) (three {base}-basic|standard|premium listings, same slug math as the console) · listEndpoint() (x402, live-probed) · resolveRef('#16'). Gasless; errors are T2000Error with the API's message. Walkthrough → docs.t2000.ai/how-to/sell-headlessly.
Factory methods, full API surface, supported assets, Cetus swap routing, x402 payments, error handling, architecture → docs.t2000.ai/agent-sdk
MIT — see LICENSE.
FAQs
TypeScript SDK for Agent Wallets on Sui — gasless USDC + USDsui transfers, Cetus swap routing, NAVI lending (programmatic), MPP paid API access, zkLogin compatible.
The npm package @t2000/sdk receives a total of 2,517 weekly downloads. As such, @t2000/sdk popularity was classified as popular.
We found that @t2000/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.