Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Javascript API for integration with EOSIO-based blockchains using EOSIO RPC API.
Documentation can be found here
The official distribution package can be found at npm.
yarn add eosjs
In order to get access to the TextEncoding
and TextDecoding
types, you need to add @types/text-encoding
as a dev dependency:
yarn add --dev @types/text-encoding
If you're using Node (not a browser) then you'll also need to make sure the dom
lib is referenced in your tsconfig.json
:
{
"compilerOptions": {
"lib": [..., "dom"]
}
}
Clone this repository locally then run yarn build-web
. The browser distribution will be located in dist-web
and can be directly copied into your project repository. The dist-web
folder contains minified bundles ready for production, along with source mapped versions of the library for debugging. For full browser usage examples, see the documentation.
Importing using ESM syntax is supported using TypeScript, webpack, or Node.js with --experimental-modules
flag
import { Api, JsonRpc, RpcError } from 'eosjs';
import { JsSignatureProvider } from 'eosjs/dist/eosjs-jssig'; // development only
Importing using commonJS syntax is supported by Node.js out of the box.
const { Api, JsonRpc, RpcError } = require('eosjs');
const { JsSignatureProvider } = require('eosjs/dist/eosjs-jssig'); // development only
const fetch = require('node-fetch'); // node only; not needed in browsers
const { TextEncoder, TextDecoder } = require('util'); // node only; native TextEncoder/Decoder
The Signature Provider holds private keys and is responsible for signing transactions.
Using the JsSignatureProvider in the browser is not secure and should only be used for development purposes. Use a secure vault outside of the context of the webpage to ensure security when signing transactions in production
const defaultPrivateKey = "5JtUScZK2XEp3g9gh7F8bwtPTRAkASmNrrftmx4AxDKD5K4zDnr"; // bob
const signatureProvider = new JsSignatureProvider([defaultPrivateKey]);
Open a connection to JSON-RPC, include fetch
when on Node.js.
const rpc = new JsonRpc('http://127.0.0.1:8888', { fetch });
Include textDecoder and textEncoder when using in Node. You may exclude these when running in a browser since most modern browsers now natively support these. If your browser does not support these (https://caniuse.com/#feat=textencoder), then you can import them as a dependency through the following deprecated npm package: https://www.npmjs.com/package/text-encoding
const api = new Api({ rpc, signatureProvider, textDecoder: new TextDecoder(), textEncoder: new TextEncoder() });
transact()
is used to sign and push transactions onto the blockchain with an optional configuration object parameter. This parameter can override the default value of broadcast: true
, and can be used to fill TAPOS fields given expireSeconds
and either blocksBehind
or useLastIrreversible
. Given no configuration options, transactions are expected to be unpacked with TAPOS fields (expiration
, ref_block_num
, ref_block_prefix
) and will automatically be broadcast onto the chain.
(async () => {
const result = await api.transact({
actions: [{
account: 'eosio.token',
name: 'transfer',
authorization: [{
actor: 'useraaaaaaaa',
permission: 'active',
}],
data: {
from: 'useraaaaaaaa',
to: 'useraaaaaaab',
quantity: '0.0001 SYS',
memo: '',
},
}]
}, {
blocksBehind: 3,
expireSeconds: 30,
});
console.dir(result);
})();
use RpcError
for handling RPC Errors
...
try {
const result = await api.transact({
...
} catch (e) {
console.log('\nCaught exception: ' + e);
if (e instanceof RpcError)
console.log(JSON.stringify(e.json, null, 2));
}
...
See LICENSE for copyright and license terms.
All repositories and other materials are provided subject to the terms of this IMPORTANT notice and you must familiarize yourself with its terms. The notice contains important information, limitations and restrictions relating to our software, publications, trademarks, third-party resources, and forward-looking statements. By accessing any of our repositories and other materials, you accept and agree to the terms of the notice.
FAQs
Talk to eos API
The npm package eosjs receives a total of 10,600 weekly downloads. As such, eosjs popularity was classified as popular.
We found that eosjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.