Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
bitfinex-api-node
Advanced tools
A Node.JS reference implementation of the Bitfinex API
npm i --save bitfinex-api-node
const { WSv2 } = require('bitfinex-api-node')
const ws = new WSv2({ transform: true })
// do something with ws client
Refer to the docs/
folder for JSDoc-generated HTML documentation, and the examples/
folder for executable examples covering common use cases.
Official API documentation at https://docs.bitfinex.com/v2/reference
Sending an order & tracking status:
const ws = bfx.ws()
ws.on('error', (err) => console.log(err))
ws.on('open', ws.auth.bind(ws))
ws.once('auth', () => {
const o = new Order({
cid: Date.now(),
symbol: 'tETHUSD',
amount: 0.1,
type: Order.type.MARKET
}, ws)
// Enable automatic updates
o.registerListeners()
o.on('update', () => {
console.log(`order updated: ${o.serialize()}`)
})
o.on('close', () => {
console.log(`order closed: ${o.status}`)
ws.close()
})
o.submit().then(() => {
console.log(`submitted order ${o.id}`)
}).catch((err) => {
console.error(err)
ws.close()
})
})
ws.open()
Cancel all open orders
const ws = bfx.ws(2)
ws.on('error', (err) => console.log(err))
ws.on('open', ws.auth.bind(ws))
ws.onOrderSnapshot({}, (orders) => {
if (orders.length === 0) {
console.log('no open orders')
return
}
console.log(`recv ${orders.length} open orders`)
ws.cancelOrders(orders).then(() => {
console.log('cancelled orders')
})
})
ws.open()
Subscribe to trades by pair
const ws = bfx.ws(2)
ws.on('error', (err) => console.log(err))
ws.on('open', () => {
ws.subscribeTrades('BTCUSD')
})
ws.onTrades({ symbol: 'tBTCUSD' }, (trades) => {
console.log(`trades: ${JSON.stringify(trades)}`)
})
ws.onTradeEntry({ symbol: 'tBTCUSD' }, (trades) => {
console.log(`te: ${JSON.stringify(trades)}`)
})
ws.open()
Old:
new BFX(API_KEY, API_SECRET, { version: 2 })
since 2.0.0:
new BFX({ apiKey: '', apiSecret: '' })
trade
and orderbook
snapshots are emitted as nested listsTo make dealing with snapshots better predictable, snapshots are emitted as an array.
Lists of raw orderbooks (R0
) are ordered in the same order as P0
, P1
,
P2
, P3
npm test
The base limit per-user is 1,000 orders per 5 minute interval, and is shared between all account API connections. It increases proportionally to your trade volume based on the following formula:
1000 + (TOTAL_PAIRS_PLATFORM * 60 * 5) / (250000000 / USER_VOL_LAST_30d)
Where TOTAL_PAIRS_PLATFORM
is the number of pairs shared between
Ethfinex/Bitfinex (currently ~101) and USER_VOL_LAST_30d
is in USD.
No; if your order fills immediately, the first packet referencing the order
will be an oc
signaling the order has closed. If the order fills partially
immediately after creation, an on
packet will arrive with a status of
PARTIALLY FILLED...
For example, if you submit a LIMIT
buy for 0.2 BTC and it is added to the
order book, an on
packet will arrive via ws2. After a partial fill of 0.1
BTC, an ou
packet will arrive, followed by a final oc
after the remaining
0.1 BTC fills.
On the other hand, if the order fills immediately for 0.2 BTC, you will only
receive an oc
packet.
I make multiple parallel request and I receive an error that the nonce is too small. What does it mean?
Nonces are used to guard against replay attacks. When multiple HTTP requests arrive at the API with the wrong nonce, e.g. because of an async timing issue, the API will reject the request.
If you need to go parallel, you have to use multiple API keys right now.
te
vs tu
MessagesA te
packet is sent first to the client immediately after a trade has been
matched & executed, followed by a tu
message once it has completed processing.
During times of high load, the tu
message may be noticably delayed, and as
such only the te
message should be used for a realtime feed.
If you enable sequencing on v2 of the WS API, each incoming packet will have a
public sequence number at the end, along with an auth sequence number in the
case of channel 0
packets. The public seq numbers increment on each packet,
and the auth seq numbers increment on each authenticated action (new orders,
etc). These values allow you to verify that no packets have been missed/dropped,
since they always increase monotonically.
Order books with precision R0
are considered 'raw' and contain entries for
each order submitted to the book, whereas P*
books contain entries for each
price level (which aggregate orders).
git checkout -b my-new-feature
)git commit -am 'Add some feature'
)git push origin my-new-feature
)FAQs
Node reference library for Bitfinex API
We found that bitfinex-api-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.