
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
jito-js-rpc
Advanced tools
The Jito JSON-RPC JavaScript SDK provides an interface for interacting with Jito's enhanced Solana infrastructure. This SDK supports methods for managing bundles and transactions, offering improved performance and additional features while interacting with the Block Engine.
getInflightBundleStatuses: Retrieve the status of in-flight bundles.getBundleStatuses: Fetch the statuses of submitted bundles.getTipAccounts: Get accounts eligible for tips.sendBundle: Submit bundles to the Jito Block Engine.sendTransaction: Submit transactions with enhanced priority and speed.This project requires Node.js and npm (Node Package Manager) for development. If you haven't installed Node.js yet, you can download it from nodejs.org.
You can install the package using npm:
npm install
Or if you prefer using yarn:
yarn add jito-js-rpc
To run the basic transaction example:
Ensure your environment is set up in examples/basic-transaction.js:
// Load the sender's keypair
const sender = loadKeypair("/path/to/wallet.json");
// Set up receiver pubkey
const receiver = new PublicKey("YOUR_RECEIVER_PUBKEY");
Run the example:
node examples/basic_txn.js
To run the basic bundle example:
Set up your environment in examples/basic-bundle.js:
// Load the sender's keypair
const sender = loadKeypair("/path/to/wallet.json");
// Set up receiver pubkey
const receiver = new PublicKey("YOUR_RECEIVER_PUBKEY");
Run the example:
node examples/basic_bundle.js
Contributions are welcome! Please feel free to submit a Pull Request.
For support, please join our Discord community.
FAQs
JavaScript RPC client for Jito
The npm package jito-js-rpc receives a total of 825 weekly downloads. As such, jito-js-rpc popularity was classified as not popular.
We found that jito-js-rpc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.