
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@ton-community/ton-ledger
Advanced tools
This library allows you to connect to a ledger device and with with TON from browser (only Chrome), NodeJS and React Native.
This library allows you to connect to a ledger device and with with TON from browser (only Chrome), NodeJS and React Native.
To add library to your project execute:
yarn add @ton-community/ton-ledger
First you need to select transport library for you environment.
Browser:
Node:
React Native:
After connecting to a device create a TonTransport instance:
import { TonTransport } from '@ton-community/ton-ledger';
let transport = new TonTransport(device);
For hardware wallets you need to specify deriviation path of your account for TON it is specified as:
function pathForAccount(testnet: boolean, workchain: number, account: number) {
let network = testnet ? 1 : 0;
let chain = workchain === -1 ? 255 : 0;
return [44, 607, network, chain, account, 0]; // Last zero is reserved for alternative wallet contracts
}
You can specify any path that starts with [44, 607]
, but it could be incompatible with other apps.
To get an address without confimration on device you can perform next things:
let testnet = true;
let workchain = 0;
let accountIndex = 0;
let bounceable = false;
let path = pathForAccount(testnet, workchain, accountIndex);
let response = await transport.getAddress(path, { chain, bounceable, testOnly: testnet });
let publiKey: Buffer = response.publicKey;
let address: string = response.address;
The same as getting address, but returns address and key only when user confirms that address on the screen is correct. This method usually used after the non-confirming one and displaying address in dApp ad then requesting address validation.
let testnet = true;
let workchain = 0;
let accountIndex = 0;
let bounceable = false;
let path = pathForAccount(testnet, workchain, accountIndex);
let response = await transport.validateAddress(path, { chain, bounceable, testOnly: testnet });
let publiKey: Buffer = response.publicKey;
let address: string = response.address;
Ledger Nanoapp works with Wallet v4 for now, we recommend you to continue to use it:
import { WalletV4Contract, WalletV4Source } from 'ton';
import { TonPayloadFormat } from '@ton-community/ton-ledger';
import { TonClient, Address, SendMode, toNano } from 'ton-core';
let client = new TonClient({ endpoint: 'https://toncenter.com/api/v2/jsonRPC' });
let source = WalletV4Source.create({ workchain: 0, publicKey: deviceAddress.publicKey });
let contract = new WalletV4Contract(address, source);
let seqno = await contract.getSeqNo();
// Parameters
let path: number[]; // Account path from above
let to: Address = Address.parse('...'); // Destination
let amount: bigint = toNano('100'); // Send 100 TON
let sendMode = SendMode.IGNORE_ERRORS | SendMode.PAY_GAS_SEPARATLY;
let timeout = Math.floor((Date.now() / 1000) + 60);
let bounce = false;
let payload: TonPayloadFormat | null = null; // See below
// Signing on device
let signed = await transport.signTransaction(path, {
to,
sendMode,
amount,
seqno,
timeout: Math.floor((Date.now() / 1000) + 60),
bounce,
payload: payload ? payload : undefined
});
// Send transaction to the network
await c.sendExternalMessage(contract, signed);
Comments are limited to ASCII-only symbols and 127 letters. Anything above would be automatically downgraded to Blind Signing Mode that you want to avoid at all cost.
const payload: TonPayloadFormat = {
type: 'comment',
text: 'Deposit'
};
const payload: TonPayloadFormat = {
type: 'jetton-transfer',
queryId: null, // null will be replaced with 0; you can pass any value of the BigInt type
amount: 1n,
destination: Address.parse('EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM9c'),
responseDestination: Address.parse('EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM9c'),
customPayload: null, // you can pass any value of the Cell type
forwardAmount: 0n,
forwardPayload: null // you can pass any value of the Cell type
};
const payload: TonPayloadFormat = {
type: 'nft-transfer',
queryId: null, // null will be replaced with 0; you can pass any value of the BigInt type
newOwner: Address.parse('EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM9c'),
responseDestination: Address.parse('EQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM9c'),
customPayload: null, // you can pass any value of the Cell type
forwardAmount: 0n,
forwardPayload: null // you can pass any value of the Cell type
};
MIT
[7.3.0] - 2025-08-21
includeWalletOp
FAQs
This library allows you to connect to a ledger device and with with TON from browser (only Chrome), NodeJS and React Native.
The npm package @ton-community/ton-ledger receives a total of 6,117 weekly downloads. As such, @ton-community/ton-ledger popularity was classified as popular.
We found that @ton-community/ton-ledger demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.