
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@volt.id/sdk
Advanced tools
Volt wallet sdk for browser. currently only support Bitcoin SV.
npm i -S @volt.id/sdk
import { Bsv } from "@volt.id/sdk";
const bsv = new Bsv();
Connect to volt wallet, if user has connected before and session is not expired, volt sdk will reconnect automatically on page loaded, otherwise, volt sdk will popup a qrcode to user to scan to connect.
await bsv.connectAccount({ network: "mainnet" }); // network: 'mainnet' | 'testnet'
note: don't call
connectAccounton page load event, callconnectAccountwhen use click your connect button and listen theaccountChangedEvent.
// bad
window.onload = function() {
await bsv.connectAccount({ network: "mainnet" });
}
// good
bsv.on('accountChanged', (depositAddress) => {
if (depositAddress) {
console.log('connected', depositAddress)
// your can transfer now
} else {
console.log('not connected')
}
})
yourConnectButton.onclick = async function() {
await bsv.connectAccount({network: 'mainnet'})
}
// change a account should disconnect before connecting
yourChangeAccountButton.onclick = async function() {
await bsv.disconnectAccount()
await bsv.connectAccount({network: 'mainnet'})
}
await bsv.disconnectAccount();
const network = await bsv.getNetwork();
const depositAddress = await bsv.getDepositAddress();
const bsvBalance = await bsv.getBsvBalance(); // returns the current wallet balance can transfer (unit: sat) e.g., {free: 300222}
const sensibleFtBalance = await bsv.getSensibleFtBalance();
/**
return :
[
{
codehash: "777e4dd291059c9f7a0fd563f7204576dcceb791",
free: "4167139",
genesis: "c52b5ee305834e3ceb97ee931ed5e453543ba2d8",
tokenDecimal: 8,
tokenName: "bsv/TSC lp token",
}
]
* /
note: where transfer bsv, list.length should be 1 and receivers.length should be 1.
const transferRes = await bsv.batchTransfer({
noBroadcast: false, // if set true, will not broadcast to bsv network, you need to broadcast it manually
list: [
{
type: "bsv",
data: {
receivers: [{ address: depositeAddress, amount: "8000" }],
},
},
],
});
note: where transfer sensible fungible token, list.length should be 1 and receivers.length should be 1.
const transferRes = await bsv.batchTransfer({
noBroadcast: true,
list: [
{
type: "sensibleFt",
data: {
codehash: "514776383faa66e4a65808904d4d6724e4774fbe",
genesis: "c57dd8e75cd6a3d11c4628328c9fa5f2d9d452b2",
receivers: [{ address: depositeAddress, amount: "303" }],
},
},
],
});
note: where transfer sensible fungible token, list.length should be 2 and receivers.length should be 1.
const transferRes = await bsv.batchTransfer({
noBroadcast: true,
list: [
{
type: "bsv",
data: {
receivers: [{ address: depositeAddress, amount: "8000" }],
},
},
{
type: "sensibleFt",
data: {
codehash: "514776383faa66e4a65808904d4d6724e4774fbe",
genesis: "c57dd8e75cd6a3d11c4628328c9fa5f2d9d452b2",
receivers: [{ address: depositeAddress, amount: "303" }],
},
},
],
});
Get signature and publicKey, currently do not support sensibleFt utxo, p2pkh utxo.
const res = await await bsv.signTx({
txHex: "xxx", // rawtx
scriptHex: "xxx", // input locking script hex
satoshis: "10000", // input satoshis
inputIndex: 0, // input index
address: "", // user address, usally deposit address
sigHashType: 65, // optinal, default
});
/**
return:
{
publicKey: 'xxx',
sig: 'xxx'
}
*/
Emitted after connected/disconnected/account changed
bsv.on('accountChanged', funciton(depositAddress) {
// depositAddress is a bsv address (string) or null
})
Emitted when network changed
bsv.on('networkChanged', function(network) {})
Emitted after disconnected
bsv.on('close', function() {})
FAQs
volt javascript sdk
We found that @volt.id/sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.