
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@two-point-five/web3-sdk
Advanced tools
This is an official 2p5 Web3 SDK for connecting to blockchain networks.
This is an official 2p5 Web3 SDK for connecting to blockchain networks.
npm installThis turborepo uses npm as a package manager. It includes the following packages/apps:
docs: a Next.js app for creating web3-sdk documentation.example-election: another Next.js app for experimenting web3-sdk package.example-smartcontract: a Hardhat project for contract development in example-election project.~web3-sdk: Main Package.eslint-config-custom: eslint configurations (includes eslint-config-next and eslint-config-prettier)tsconfig: tsconfig.jsons used throughout the monorepoEach package/app is 100% TypeScript.
This turborepo has some additional tools already setup for you:
To build all apps and packages, run the following command:
cd web3-sdk
npm run build
To develop all apps and packages, run the following command:
cd web3-sdk
npm run dev
if you want to test the package, you should start the project 2p5 Wallet first. and make sure the variable TPF_BASEURL_DEVELOPMENT in file packages/~web3-sdk/src/modules/widgets/WidgetManager.ts is same as the url in 2p5 Wallet project that you start before.
Turborepo can use a technique known as Remote Caching to share cache artifacts across machines, enabling you to share build caches with your team and CI/CD pipelines.
By default, Turborepo will cache locally. To enable Remote Caching you will need an account with Vercel. If you don't have an account you can create one, then enter the following commands:
cd my-turborepo
npx turbo login
This will authenticate the Turborepo CLI with your Vercel account.
Next, you can link your Turborepo to your Remote Cache by running the following command from the root of your turborepo:
npx turbo link
Learn more about the power of Turborepo:
import Web3 from 'web3';
import TPFWeb, { withTPFProvider } from '@two-point-five/web3-sdk';
function initiateWeb3() {
/**
* string `test` is your dApp ID, but we haven't implemented it for now, so just fill it freely
* string `goerli` is blockchain network. we have: "mainnet" | "goerli" | "sandbox2p5". choose one.
* */
const tpf = new TPFWeb('test', 'goerli', {
environment: 'staging'
});
// pass the provider into Web3 instance
const web3 = new Web3(tpf.provider);
web3.eth.handleRevert = true;
return web3;
}
/** example to get public address and balance */
async function getAccounts() {
const web3 = initiateWeb3();
try {
const accounts = await web3.eth.getAccounts();
const balance = await web3.eth.getBalance(accounts[0]);
console.log({ accounts, balance });
} catch (err) {
console.error({ err });
}
}
/**
* of course, you can use `web3` instance like usual.
* @see: https://web3js.readthedocs.io/en/v1.10.0/web3.html#example-local-geth-node
*/
// get TPF Provider
const provider = withTPFProvider(web3.currentProvider)
console.log(provider.isWalletConnected());
console.log(provider.getAccessToken());
FAQs
This is an official 2p5 Web3 SDK for connecting to blockchain networks.
We found that @two-point-five/web3-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.