Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@turnkey/eip-1193-provider
Advanced tools
The @turnkey/eip-1193-provider
package delivers a Turnkey-compatible Ethereum provider that adheres to the EIP-1193 standards. It's built to integrate seamlessly with a broad spectrum of EVM-compatible chains, offering capabilities like account management, transaction signing, and blockchain interaction. This initial setup is intended for use in conjunction with the @turnkey/http
and @turnkey/webauthn-stamper
package, for initial authentication.
Before you start using the Turnkey EIP-1193 Provider, make sure to install the necessary packages in your project. This guide assumes you have a Node.js environment ready for development.
Install the required packages using NPM or Yarn:
npm install @turnkey/eip-1193-provider @turnkey/http @turnkey/webauthn-stamper
pnpm add @turnkey/eip-1193-provider @turnkey/http @turnkey/webauthn-stamper
yarn add @turnkey/eip-1193-provider @turnkey/http @turnkey/webauthn-stamper
To set up the Turnkey EIP-1193 Provider, you need to initialize it with your configuration, which includes setting up the Turnkey client with your base URL and stamper.
import { WebauthnStamper } from "@turnkey/webauthn-stamper";
import { TurnkeyClient } from "@turnkey/http";
const stamper = new WebauthnStamper({
rpId: "example.com",
});
// Initialize the Turnkey HTTP client
const turnkeyClient = new TurnkeyClient(
{ baseUrl: "https://api.turnkey.com" },
stamper
);
// Get the organizationId of the sub-organization connected to the users account
const { organizationId } = await turnkeyClient.getWhoami({
organizationId: process.env.ORGANIZATION_ID,
});
// Get the user wallets associated with their sub-organization
const { wallets } = await turnkeyClient.getWallets({
organizationId,
});
// Get the walletId to connect to the provider
const walletId = wallets[0].walletId;
const chain = {
chainName: "Ethereum Mainnet",
chainId: "0x1",
rpcUrls: ["https://mainnet.infura.io/v3/your-infura-project-id"],
};
// Initialize the EIP-1193 Provider with your configuration
const provider = await createEIP1193Provider({
walletId,
organizationId,
turnkeyClient,
chains: [
chain,
// Add more chains as needed
],
});
eth_requestAccounts
Requests the user to provide an Ethereum address for identification, as specified by EIP-1102. This method initiates connectivity with the client and will prompt for passkey authentication.
const accounts = await provider.request({ method: "eth_requestAccounts" });
// Logs the array accounts associated with the provided walletId & organization
console.log(accounts);
The following methods also prompt for passkey authentication:
personal_sign
: Signs a message with the specified account.eth_sign
: Signs data with the specified account.eth_signTransaction
: Signs a transaction with the specified account.eth_signTypedData_v4
: Signs typed data according to EIP-712 with the specified account.eth_sendTransaction
: Submits a transaction to the network for execution..env.example
to .env.local
cp .env.example .env
pnpm anvil
pnpm test
We welcome contributions to improve the Turnkey EIP-1193 Provider
. Please follow the project's contribution guidelines.
This project is licensed under LICENSE, with detailed information available in the repository.
FAQs
EIP-1193 Provider for Turnkey.
The npm package @turnkey/eip-1193-provider receives a total of 21 weekly downloads. As such, @turnkey/eip-1193-provider popularity was classified as not popular.
We found that @turnkey/eip-1193-provider demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.