
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
First, install Typescript in your project (for more information see Why Typescript?):
npm i typescript --save-dev
Then, install the SDK's npm package:
npm i dcl-sdk --save-dev
Specify a build.json file, this is used to easily configure build steps:
[
{
"name": "Compile systems",
"kind": "Webpack",
"file": "./scene.tsx",
"target": "webworker"
}
]
Finally, add a new command to your npm scripts:
"scripts": {
"build": "dcl-scripting build.json"
}
Run that command to transpile your Typescript files on-demand.
From here on you can use the CLI to deploy your scene.
Typescript is a superset of Javascript and allows Object Oriented Programming as well as type declaration, Both this featues are key when aiming to provide a good developer experience. Features like autocomplete and type-checking speed up development times and allow for the creation of a solid codebase.
If you wish to use another tool or language, you are free to do so as long as the end result is a single Javascript file (scene.js). Keep in mind that all provided type declarations are Typescript only, so other languages and transpilers will lack official support.
To use JSX syntax inside your script you need to import the following module:
import { createElement } from 'dcl-sdk'
And use it like:
// @inject("EntityController") entityController: EntityController | null = null;
async render() {
await this.entityController!.render(<a-box position="0 0 0" />)
}
All these APIs are experimental and are bound to change before the stable release of the World
Exposes information about the player's position inside an Estate.
Exposes methods that allow scripts to interact with entities in various ways.
Contains logic to require and perform ethereum transactions from within a script.
Contains the definition of a parcel as obtained from the blockchain.
Exposes methods for playing sounds in various maners.
Exposes methods to access information provided by Metamask.
This code is distributed under the Apache 2.0 license
FAQs
Decentraland SDK
We found that dcl-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.