
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@thru/wallet-store
Advanced tools
Browser-side IndexedDB storage layer for the Thru wallet. Provides typed helpers for persisting accounts, connected dApps, and passkey profiles in a single unified database. Replaces the legacy `@thru/indexed-db-stamper` package.
Browser-side IndexedDB storage layer for the Thru wallet. Provides typed helpers for persisting accounts, connected dApps, and passkey profiles in a single unified database. Replaces the legacy @thru/indexed-db-stamper package.
pnpm add @thru/wallet-store
import {
AccountStorage,
ConnectedAppsStorage,
loadPasskeyProfiles,
savePasskeyProfiles,
} from '@thru/wallet-store';
// Save and retrieve accounts
await AccountStorage.saveAccount({
index: 0,
label: 'Main',
publicKey: '...',
path: "m/44'/501'/0'/0'",
createdAt: new Date(),
});
const accounts = await AccountStorage.getAccounts();
// Track connected dApps per account
await ConnectedAppsStorage.upsert({
accountId: 0,
appId: 'my-dapp',
origin: 'https://my-dapp.example',
metadata: { name: 'My dApp', icon: '...' },
});
const apps = await ConnectedAppsStorage.listByAccount(0);
// Manage passkey profiles
const store = await loadPasskeyProfiles();
if (store) {
await savePasskeyProfiles(store);
}
thru-wallet v1) with lazy singleton connectionupdateProfilePasskey, updatePasskeyLastUsed) that separate mutation from persistencenull / false when window is undefinedThe package opens a single IndexedDB database named thru-wallet at version 1 with three object stores:
| Store | Key | Indexes | Purpose |
|---|---|---|---|
accounts | index | by-created | HD wallet account metadata |
connectedApps | accountId:appId | by-account, by-updated | Authorized dApp connections |
passkeyProfiles | id | -- | WebAuthn passkey profiles and settings |
Access the raw database connection when needed:
import { getUnifiedDB } from '@thru/wallet-store';
const db = await getUnifiedDB();
| Method | Description |
|---|---|
saveAccount(account) | Insert or update an account record |
getAccounts() | List all accounts sorted by index |
getAccount(index) | Fetch a single account by its BIP-44 index |
updateAccountLabel(index, label) | Rename an account |
getNextAccountIndex() | Return the next unused account index |
hasAccounts() | Check whether any accounts exist |
getAccountCount() | Return total account count |
clearAccounts() | Delete all account records |
| Method | Description |
|---|---|
upsert(app) | Insert or update a connected app record |
listByAccount(accountId) | List apps for an account, most recently updated first |
get(accountId, appId) | Fetch a single connection record |
remove(accountId, appId) | Delete a connection |
clear() | Delete all connected app records |
| Function | Description |
|---|---|
loadPasskeyProfiles() | Load all profiles and settings from IndexedDB |
savePasskeyProfiles(store) | Persist the full profile store (replaces all records) |
createDefaultProfileStore() | Create an in-memory store with one empty default profile |
updateProfilePasskey(store, index, passkey) | Pure transform: attach passkey metadata to a profile |
updatePasskeyLastUsed(store, index) | Pure transform: bump lastUsedAt timestamp |
idb -- Promise-based IndexedDB wrapper@thru/chain-interfaces -- shared type definitionsFAQs
Browser-side IndexedDB storage layer for the Thru wallet. Provides typed helpers for persisting accounts, connected dApps, and passkey profiles in a single unified database. Replaces the legacy `@thru/indexed-db-stamper` package.
The npm package @thru/wallet-store receives a total of 8 weekly downloads. As such, @thru/wallet-store popularity was classified as not popular.
We found that @thru/wallet-store demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.