
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@usdu-core/usdu-core
Advanced tools
// yarn run <command> args...
"wallet": "npx ts-node helper/wallet.info.ts",
"wallet:info": "npx ts-node helper/wallet.info.ts",
"compile": "npx hardhat compile",
"test": "npx hardhat test",
"coverage": "npx hardhat coverage",
"deploy": "npx hardhat ignition deploy",
"verify": "npx hardhat verify",
"npm:build": "tsup",
"npm:publish": "npm publish --access public"
yarn install
See .env.example
file: .env
DEPLOYER_SEED="test test test test test test test test test test test junk"
DEPLOYER_SEED_INDEX=1
ALCHEMY_RPC_KEY=...
ETHERSCAN_API=...
Create new session or re-navigate to the current directory, to make sure environment is loaded from
.env
Develop your contracts in the
/contractsdirectory and compile with:
yarn run compile # Compiles all contracts
All test files are located in /test directory. Run tests using:
yarn run test # Run all tests
yarn run test test/Membership.ts # Run specific test file
yarn run coverage # Generate test coverage report
/ignition/params/[file].ts for type conform deployment params/ignition/module/[file].ts for workflow of deploymentDeployment modules are located in
/ignition/modules. Deploy your contracts:
yarn run deploy ignition/modules/MembershipFactory.ts --network polygon --verify --deployment-id Membership01
--> increase: deployment-id
This will:
/ignition/deploymentsVerify:
Key deployment files:
deployed_addresses.json: Contains contract addresses
journal.json: Detailed deployment logs
creates deployment artifacts in /ignition/deployments directory
creates ./ignition/deployments/[deployment]/deployed_addresses.json
creates ./ignition/deployments/[deployment]/journal.jsonl
creates constructor-args in /ignition/constructor-args directory, as JS module export
✔ Confirm deploy to network polygon (137)? … yes
{
message: 'Config Info: Deploying Module with accounts',
admin: '0xb687FE7E47774B22F10Ca5E747496d81827167E3',
executor: '0xBdae8D35EDe5bc5174E805DcBe3F7714d142DAAb',
member: '0x2ACf17C04F1d8BE7E9D5529894DCee86bf2fcdC3'
}
Constructor Args
[
'0xb687FE7E47774B22F10Ca5E747496d81827167E3',
'0xBdae8D35EDe5bc5174E805DcBe3F7714d142DAAb',
'0x2ACf17C04F1d8BE7E9D5529894DCee86bf2fcdC3'
]
Hardhat Ignition 🚀
Deploying [ MembershipModule ]
Batch #1
Executed MembershipModule#Membership
Batch #2
Executed MembershipModule#Storage
[ MembershipModule ] successfully deployed 🚀
Deployed Addresses
MembershipModule#Membership - 0x72950A0A9689fCA941Ddc9E1a58dcD3fb792E3D2
MembershipModule#Storage - 0x8A7e8091e71cCB7D1EbDd773C26AD82AAd323328
Verifying deployed contracts
Verifying contract "contracts/Membership.sol:Membership" for network polygon...
Contract contracts/Membership.sol:Membership already verified on network polygon:
- https://polygonscan.com/address/0x72950A0A9689fCA941Ddc9E1a58dcD3fb792E3D2#code
Verifying contract "contracts/Storage.sol:Storage" for network polygon...
Contract contracts/Storage.sol:Storage already verified on network polygon:
- https://polygonscan.com/address/0x8A7e8091e71cCB7D1EbDd773C26AD82AAd323328#code
✨ Done in 69.96s.
npx hardhat verify --network polygon --constructor-args ./ignition/constructor-args/$FILE.js $ADDRESS
or manually include unrelated contracts by creating or using /ignition/constructor-args/[file].js
npx hardhat ignition verify $DEPLOYMENT --include-unrelated-contracts
Export contract ABIs for npm package usage by copying the JSON into dedicated TypeScript files:
file: exports/abis/...
export const StorageABI = [
...
JSON
...
] as const;
Provides a mapping of contract addresses for the Membership and Storage contracts deployed on different blockchain networks.
The ADDRESS object contains the contract addresses for the mainnet and polygon networks, with the network ID as the key.
The zeroAddress is used as a placeholder for the mainnet network, as the contracts have not been deployed there yet.
file: exports/address.config.ts
import { mainnet, polygon } from 'viem/chains';
import { Address, zeroAddress } from 'viem';
export interface ChainAddress {
membership: Address;
storage: Address;
}
export const ADDRESS: Record<number, ChainAddress> = {
[mainnet.id]: {
membership: zeroAddress,
storage: zeroAddress,
},
[polygon.id]: {
membership: '0x72950A0A9689fCA941Ddc9E1a58dcD3fb792E3D2',
storage: '0x8A7e8091e71cCB7D1EbDd773C26AD82AAd323328',
},
};
Config: /tsup.config.ts
TSUP bundles TypeScript code into optimized JavaScript packages. This package uses TSUP to create production-ready builds.
yarn run build
Increase Version: Update version number in package.json using semantic versioning (e.g. 0.0.1 -> 0.0.2) before publishing new changes.
file: /package.json
"name": "@wrytlabs/core-template",
"version": "0.0.1", <-- HERE
Login to your NPM account
npm login
This will publish your package to NPM with public access, making it available for anyone to install and use.
yarn run publish
To publish new version. publish: "npm publish --access public"
Note: During npm package publishing, the command may execute twice. The second execution will fail with a version conflict since the package is already published. This is expected behavior and the first publish will have succeeded.
(not needed, since its already a true JS bundled module)
E.g. for NextJs using the next.config.js in root of project.
/** @type {import('next').NextConfig} */
const nextConfig = {
reactStrictMode: true,
transpilePackages: ['@wrtylabs/core', '@wrytelabs/api'],
};
module.exports = nextConfig;
FAQs
Core implementation
We found that @usdu-core/usdu-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.