
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
@xstocker/agent-sdk
Advanced tools
SDK for AI agents to trade tokenized U.S. stocks (xStocks) on Solana via the xStocker Agent API.
SDK for AI agents to trade tokenized U.S. stocks (xStocks) on Solana.
No account. No API key. No OAuth. This SDK only reads public data and builds unsigned transactions — it never touches a private key. You (or your agent framework's wallet adapter) are responsible for signing and broadcasting the returned transaction.
npm install @xstocker/agent-sdk
import { xstocker } from "@xstocker/agent-sdk";
// 1. Discover tradable assets — reads the static list at
// https://xstocker.com/agent/assets.json (CDN file, no API call)
const { assets, payTokens } = await xstocker.getAssets();
// 2. Build an unsigned buy transaction
const order = await xstocker.buildOrder({
wallet: "USER_SOLANA_ADDRESS",
asset: "NVDAx",
amount: 100,
payToken: "USDC", // or "SOL"
side: "buy", // or "sell"
});
console.log(order.details);
// { side: 'buy', asset: 'NVDAx', amountIn: '100 USDC',
// expectedOut: '0.470123 NVDAx', fee: '0.002350 NVDAx', ... }
// 3a. If your agent CAN sign transactions programmatically (e.g. it has its
// own wallet adapter), sign order.transaction (base64) with the user's
// own wallet and send it. It expires after roughly a minute, so build it
// right before signing and rebuild if it runs out.
// 3b. If your agent CANNOT sign transactions (e.g. a plain chat bot with no
// wallet access), hand the user order.solanaPayUrl instead, as a link or
// a QR code. Their wallet (e.g. Phantom) opens it and requests a fresh
// transaction at the moment they approve, so nothing expires in between:
console.log(order.solanaPayUrl);
// "solana:https%3A%2F%2Fxstocker.com%2Fagent%2Fpay%3Fasset%3DNVDAx%26amount%3D100..."
// (not returned when partnerId is used — see Referral partners)
// 4. Verify it landed
const status = await xstocker.getOrderStatus(signature);
console.log(status.status); // "confirmed" | "finalized" | "processed" | "failed" | "not_found"
await xstocker.buildOrder({
wallet: "USER_SOLANA_ADDRESS",
asset: "NVDAx",
amount: 0.5, // amount of NVDAx to sell
payToken: "USDC", // token you receive
side: "sell",
});
// Register once — get a partner_id
const { partner_id } = await xstocker.registerPartner("YOUR_PAYOUT_WALLET_ADDRESS");
// Include it on every buildOrder() call — adds a small extra fee that
// accrues to your wallet, on top of the standard platform fee.
const order = await xstocker.buildOrder({
wallet: "USER_SOLANA_ADDRESS",
asset: "NVDAx",
amount: 100,
partnerId: partner_id,
});
// Confirm your earnings once the trade actually lands on-chain
await xstocker.getOrderStatus(signature, order.details.partnerRef);
// Check accrued earnings anytime
const info = await xstocker.getPartnerInfo(partner_id);
console.log(info.commission, info.availableToWithdraw);
import { XStockerAgentClient } from "@xstocker/agent-sdk";
const client = new XStockerAgentClient({ baseUrl: "https://api.xstocker.com" });
getAssets() reads a static file from the CDN, not the API. asset in
buildOrder() accepts the ticker in any letter case (the trailing "x" is
optional) or the token's mint address.
import { XStockerAgentError } from "@xstocker/agent-sdk";
try {
await xstocker.buildOrder({ wallet, asset: "NVDAx", amount: 100 });
} catch (err) {
if (err instanceof XStockerAgentError) {
console.error(err.code, err.message); // e.g. "no_route", "invalid_wallet"
}
}
MIT
FAQs
SDK for AI agents to trade tokenized U.S. stocks (xStocks) on Solana via the xStocker Agent API.
The npm package @xstocker/agent-sdk receives a total of 0 weekly downloads. As such, @xstocker/agent-sdk popularity was classified as not popular.
We found that @xstocker/agent-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.