
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Warning: This library is still in development and it is not production ready.
A JavaScript/TypeScript library for interacting with the Coreum Blockchain
This is the recommended library for integrating a JavaScript/TypeScript app with the Coreum Blockchain, especially for the use of the modules assetft, assetnft, and more. It supports integration with the most popular Browser-Extension wallets; like Keplr, Cosmostation and Leap.
Warning IF YOU DECIDE TO USE A MNEMONIC SIGNER, FOR BETTER SECURITY USE ONLY ON THE SERVER-SIDE.
Installing coreum-js
npm i coreum-js
coreum-js comes with out-of-the-box modules to query the Coreum Blockchain.
coreum-js comes with out-of-the-box modules to create transaction messages compatible with the Cosmos-SDK and Coreum Blockchain.
import { Client } from "coreum-js";
// Choose the network to connect. The library will use default nodes for this.
const network = "mainnet" | "testnet" | "devnet";
const coreum: Client = new Client({ network: network });
const connectOptions = {
withWS: true | false, // optional
};
// connect() will only connect for querying purposes, it won't sign any transaction.
// In order to sign transactions, you need to connect with connectWithExtension or with connectWithMnemonic,
// If choose connectWithMnemonic, DO NOT USE ON CLIENT SIDE.
await coreum.connect(connectOptions); // connectWithExtension || connectWithMnemonic
// If withWS is true, the client will also create and connect to the Coreum Websocket.
// Client exposes different QueryClients to query the Coreum Blockchain with ease.
const {
ft,
nft,
staking,
distribution,
mint,
auth,
bank,
ibc,
gov,
feegrant,
nftbeta,
tx,
wasm,
} = coreum.queryClients;
// Documentation for each query client can be found here
// https://docs.coreum.dev/api/api.html
// You can get the TX Fee for any transactions with getTxFee
const msgs: readonly EncodeObject[];
const txFee = await coreum.getTxFee(msgs);
// Sign and broadcast the Transaction
const response = await coreum.sendTx(msgs);
// Subscribe to Blockchain events
const subscription = await coreum.subscribeToEvent($EVENT);
// Event
subscription.events.on($EVENT, ({ events, data }) => {
console.log("EVENT HAPPENED");
});
// Close the subscription
subscription.unsubscribe();
// Coreum + Cosmos Registry. coreum-js uses it internally, but it exposes it in case you have other uses for it
const registry = Client.getRegistry();
// We take the bank query client from the coreum instance.
const { bank } = coreum.queryClients;
const address = "core1ll9gdh5ur6gyv6swgshcm4zkkw4ttakt4ukjma";
const balances = await bank.allBalances(address);
// We take the Bank Transaction Module from the Library.
// Note: This TX module and the Query module are different thing. Query Module is ONLY for queries, not transaction handling
import { Bank } from "coreum-js";
// The Bank module, as any of the other TX modules, offer a quick way to create a msg to be signed and submitted to the blockchain.
// We are creating a MsgSend to transfer coins from one account to another
const send_message = Bank.Send({
// Address of the sender
fromAddress: $SENDER_ADDRESS,
// Address of the receiver
toAddress: $RECEIVER_ADDRESS,
// An array of balances to transfer { denom: "subunit of the token", amount: "amount of the subunit to transfer" }
amount: [
{
denom: "ucore",
amount: "1000000",
},
],
});
// We submit the message by passing it inside the array argument of the sendTx method of the coreum instance.
// This allows to submit multiple message on one single transaction.
const response = await coreum.sendTx([send_message]);
// The event is the typeUrl of the desired Msg to track.
// You can read more about Event subscription here.
// https://docs.cosmos.network/v0.46/core/events.html#examples
const event = "message.action='/coreum.assetft.v1.MsgMint'";
// Start subscription
const subscription = await coreum.subscribeToEvent(event);
// The event used to subcribe, would be the same one to listen to when it happens.
subscription.events.on(event, (eventData) => {
// data can be of any type and any shape. Each Event has its unique form.
// events are the events on the blockchain triggered by the transaction
const { data, events } = eventData;
});
// Unsubscribe from the event
subscription.unsubscribe();
FAQs
JS/TS Library to to easily make use of the Coreum Blockchain
The npm package coreum-js receives a total of 136 weekly downloads. As such, coreum-js popularity was classified as not popular.
We found that coreum-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.