
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@test-talk/tolk-js
Advanced tools
Tolk is a new language for writing smart contracts in TON. Think of Tolk as the "next-generation FunC". Tolk compiler is literally a fork of FunC compiler, introducing pretty syntax, but leaving all low-level optimizations untouched.
tolk-js is a WASM wrapper for Tolk compiler.
Blueprint uses tolk-js to compile .tolk
files,
so if you develop contracts with blueprint, you don't have to install tolk-js directly.
However, you can use tolk-js without blueprint, it has a simple and straightforward API.
tolk-js works both in Node.js and browser (does not depend on filesystem).
yarn add @ton/tolk-js
// or
npm install @ton/tolk-js
Its purpose is to launch a Tolk compiler from command-line, without compiling ton repo from sources, without installing apt/homebrew packages, etc. Just run
npx @ton/tolk-js --output-json out.json contract.tolk
Output JSON will contain fiftCode
, codeBoc64
, codeHashHex
, and other fields (launch to see).
There are some flags like --cwd
, --output-fift
, and others (run npx @ton/tolk-js --help
).
import {runTolkCompiler, getTolkCompilerVersion} from "@ton/tolk-js"
async function compileMainTolk() {
// for example, file `main.tolk` is saved nearby
// fsReadCallback (below) is called for both main.tolk and all its imports
let result = await runTolkCompiler({
entrypointFileName: 'main.tolk',
fsReadCallback: path => fs.readFileSync(__dirname + '/' + path, 'utf-8')
})
if (result.status === 'error') {
throw result.message
}
console.log(result.fiftCode)
// using result.codeBoc64, you can construct a cell
let codeCell = Cell.fromBoc(Buffer.from(result.codeBoc64, "base64"))[0]
// result has several (probably useful) fields, look up TolkResultSuccess
}
async function showTolkVersion() {
let version = await getTolkCompilerVersion()
console.log(`Tolk v${version}`)
}
The only point to pay attention at is fsReadCallback
. It's called for every .tolk
file, input or imported, and you should synchronously return file contents.
tolk-js does not access filesystem itself, it just provides a flexible callback, so you can make it easily work if you have file contents in memory, for example:
let sources = {
'main.tolk': 'import "utils/math.tolk"',
'utils/math.tolk': '...',
}
runTolkCompiler({
entrypointFileName: 'main.tolk',
fsReadCallback: path => sources[path],
})
The function runTolkCompiler()
accepts the following properties (look up TolkCompilerConfig
):
entrypointFileName
— obviousfsReadCallback
— explained aboveoptimizationLevel
(default 2) — controls Tolk compiler stack optimizerwithStackComments
(default false) — Fift output will contain comments, if you wish to debug its outputexperimentalOptions
(default '') — you can pass experimental compiler options hereTolk standard functions (beginCell
, assertEndOfSlice
, and lots of others) are available out of the box (if you worked with FunC earlier, you had to download stdlib.fc and store in your project; in Tolk, you don't need any additional files).
It works, because all stdlib files are embedded into JS, placed near wasm. If you import "@stdlib/tvm-dicts"
for example, tolk-js will handle it, fsReadCallback
won't be called.
Note, that folder tolk-stdlib/
and files within it exist only for IDE purposes. For example, if you use blueprint or tolk-js directly, JetBrains and VS Code plugins locate this folder and auto-complete stdlib functions.
FAQs
Tolk language compiler (smart contracts in TON)
We found that @test-talk/tolk-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.