
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A powerful CLI for DeFi operations on Base, Citrea, HyperEVM, and Monad, powered by Fibrous.
A command-line tool for DeFi operations on Base, Citrea, HyperEVM, and Monad, powered by Fibrous aggregation and Privy Server Wallets.
--json flag for scripting and pipelines# Email OTP
npx fibx auth login user@example.com
npx fibx auth verify user@example.com 123456
# Or import a private key
npx fibx auth import
# Logout
npx fibx auth logout
# Check status
npx fibx status
Use -c or --chain to specify the target chain. Default is base.
Supported: base, citrea, hyperevm, monad
You can configure custom RPC URLs to avoid rate limits on public endpoints.
# Set a custom RPC URL for a chain
npx fibx config set-rpc base https://mainnet.base.org
# View current RPC URL
npx fibx config get-rpc base
# List all custom configurations
npx fibx config list
npx fibx balance
npx fibx balance --chain citrea
npx fibx send 0.001 0xRecipient # Send native token on Base (ETH)
npx fibx send 10 0xRecipient USDC # Send ERC-20 on Base
npx fibx send 1 0xRecipient --chain monad # Send on Monad native token (MON)
npx fibx trade <amount> <from> <to>
npx fibx trade 0.0001 ETH USDC
npx fibx trade 20 USDC DAI
npx fibx trade 1 MON USDC --chain monad
Options: --slippage <n> (default: 0.5%), --approve-max, --json
Note: The
tradecommand automatically detects Wrap (Native -> Wrapped) and Unwrap (Wrapped -> Native) operations and executes them directly via contract calls, bypassing aggregator routing to save gas.
npx fibx tx-status <hash>
npx fibx tx-status 0x123...abc --chain monad
npx fibx address # Print wallet address
npx fibx wallets <email> # List active wallet
npx fibx aave status # Account health
npx fibx aave supply 1 ETH # Auto-wraps ETH -> WETH and supplies
npx fibx aave supply 100 USDC # Supply ERC-20
npx fibx aave borrow 50 USDC # Borrow
npx fibx aave repay 50 USDC # Repay
npx fibx aave repay max ETH # Auto-wraps ETH and repays full WETH debt
npx fibx aave withdraw max ETH # Withdraws WETH and auto-unwraps to ETH
Note:
supply,repay, andwithdrawsupport automatic ETH <-> WETH wrapping/unwrapping on Base.
For AI agent integration, see the fibx-skills directory.
FAQs
A powerful CLI for DeFi operations on Base, Citrea, HyperEVM, and Monad, powered by Fibrous.
The npm package fibx receives a total of 56 weekly downloads. As such, fibx popularity was classified as not popular.
We found that fibx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.