
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@tonpay/sdk
Advanced tools
JavaScript SDK for Tonpay
npm install @tonpay/sdk
or with yarn
yarn add @tonpay/sdk
Full documentation for this SDK is available on GitBook.
import { Tonpay } from "@tonpay/sdk";
// implement a Sender interface from 'ton' library or use @tonpay/react package for useSender() hook
// hint: you don't need sender if you don't plan to interact with the TON Blockchain (i.e. if you only want to generate payment links or fetch info)
const sender = buildSender();
// create Tonpay instance
const tonpay = Tonpay.create("testnet", sender);
// get your interactive store by address
const store = tonpay.getStore(
"EQCD39VS5jcptHL8vMjEXrzGaRcCVYto7HUn4bpAOg8xqB2N"
);
// get a payment link and provide it in any form (button, QR code) to the customer
const paymentLink = await store.getRequestPurchaseLink({
invoiceId: "test_invoice_id",
amount: 5
}, "tonkeeper");
// or initiate a purchase request and get the invoice address even before it's created on-chain
const invoice = await store.requestPurchase({
invoiceId: "test_invoice_id",
amount: 5 // TON
});
// now you can monitor invoice status manually
const isPaid = await invoice.isPaid();
// or redirect to hosted checkout page that'll display the payment state automatically
const hostedCheckoutUrl = `https://pay.thetonpay.app/i/${invoice.address}`;
window.location.href = hostedCheckoutUrl;
Demo store that uses this SDK can be found here.
Contact @Arterialist if you have questions and open issues on github, if there are any.
FAQs
Tonpay JavaScript SDK
We found that @tonpay/sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.