
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@xmtp/botkit
Advanced tools
Minimal viable package for creating bots.
For a streamlined setup process, you can use the create-xmtp-bot
CLI tool, which simplifies the creation and configuration of new XMTP bots.
npx create-xmtp-bot@latest bot-name
Please refer to its documentation.
Here's a basic example of the code with a bot that responds with a gm:
import { run, HandlerContext } from "@xmtp/botkit";
run(async (context: HandlerContext) => {
// Get the message and the address from the sender
const { content, senderAddress } = context.message;
// To reply, just call `reply` on the HandlerContext.
await context.reply(`gm`);
});
See more examples in the Awesome XMTP ⭐️ repo
Here’s how to easily deploy this bot:
Head to the tutorial on how to deploy an XMTP bot on Railway
To develop on this repo clone the repository containing the bot code:
git clone https://github.com/xmtp/botkit
cd botkit
# copy env variables template
cp .env.example .env
Set the variables
KEY= # 0x... the private key of the bot (with the 0x prefix)
XMTP_ENV=production # or `dev`
⚠️ Bot kit is not compatible with
bun
yet. Usenpm
oryarn
# install dependencies
yarn install
# running the bot
yarn build
yarn start
# to run with hot-reload
yarn build:watch
yarn start:watch
# run the gm example
yarn build:watch
yarn start:gm
Test the bots in messaging apps
Learn about the nearly 2 million identities part of XMTP by visiting this Dune dashboard.
FAQs
Minimal viable package for creating bots.
We found that @xmtp/botkit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.