
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
kucoin-api-node
Advanced tools
EARLY BETA. Node.js connector for gate.io REST APIs and WebSockets, with TypeScript & end-to-end tests.
WARNING: This package is still early beta, following the designs of my other connectors. If you want to stay informed when this may be ready for testing, please get in touch via telegram.
Node.js connector for the Kucoin APIs and WebSockets, with TypeScript & browser support.
npm install --save kucoin-api-node
Check out my related projects:
Most methods accept JS objects. These can be populated using parameters specified by Kucoin's API documentation.
This project uses typescript. Resources are stored in 3 key structures:
Inverse, linear & spot WebSockets can be used via a shared WebsocketClient. However, make sure to make one instance of WebsocketClient per market type (spot vs inverse vs linear vs linearfutures):
const { WebsocketClient } = require('kucoin-api-node');
const API_KEY = 'xxx';
const PRIVATE_KEY = 'yyy';
const wsConfig = {
key: API_KEY,
secret: PRIVATE_KEY,
/*
The following parameters are optional:
*/
// defaults to false == testnet. Set to true for livenet.
// livenet: true
// NOTE: to listen to multiple markets (spot vs inverse vs linear vs linearfutures) at once, make one WebsocketClient instance per market
// defaults to inverse:
// market: 'inverse'
// market: 'linear'
// market: 'spot'
// how long to wait (in ms) before deciding the connection should be terminated & reconnected
// pongTimeout: 1000,
// how often to check (in ms) that WS connection is still alive
// pingInterval: 10000,
// how long to wait before attempting to reconnect (in ms) after connection is closed
// reconnectTimeout: 500,
// config options sent to RestClient (used for time sync). See RestClient docs.
// restOptions: { },
// config for axios used for HTTP requests. E.g for proxy support
// requestOptions: { }
// override which URL to use for websocket connections
// wsUrl: 'wss://stream.bytick.com/realtime'
};
const ws = new WebsocketClient(wsConfig);
// subscribe to multiple topics at once
ws.subscribe(['position', 'execution', 'trade']);
// and/or subscribe to individual topics on demand
ws.subscribe('kline.BTCUSD.1m');
// Listen to events coming from websockets. This is the primary data source
ws.on('update', data => {
console.log('update', data);
});
// Optional: Listen to websocket connection open event (automatic after subscribing to one or more topics)
ws.on('open', ({ wsKey, event }) => {
console.log('connection open for websocket with ID: ' + wsKey);
});
// Optional: Listen to responses to websocket queries (e.g. the response after subscribing to a topic)
ws.on('response', response => {
console.log('response', response);
});
// Optional: Listen to connection close event. Unexpected connection closes are automatically reconnected.
ws.on('close', () => {
console.log('connection closed');
});
// Optional: Listen to raw error events.
// Note: responses to invalid topics are currently only sent in the "response" event.
ws.on('error', err => {
console.error('ERR', err);
});
See websocket-client.ts for further information.
Note: for linear websockets, pass linear: true in the constructor options when instancing the WebsocketClient. To connect to both linear and inverse websockets, make two instances of the WebsocketClient.
Pass a custom logger which supports the log methods silly, debug, notice, info, warning and error, or override methods from the default logger as desired.
const { WebsocketClient, DefaultLogger } = require('kucoin-api-node');
// Disable all logging on the silly level
DefaultLogger.silly = () => {};
const ws = new WebsocketClient(
{ key: 'xxx', secret: 'yyy' },
DefaultLogger
);
Build a bundle using webpack:
npm installnpm buildnpm packThe bundle can be found in dist/. Altough usage should be largely consistent, smaller differences will exist. Documentation is still TODO.
Support my efforts to make algo trading accessible to all - register with my referral links:
Or buy me a coffee using any of these:
1C6GWZL1XW3jrjpPTS863XtZiXL1aTK7Jk0xd773d8e6a50758e1ada699bb6c4f98bb4abf82daContributions are encouraged, I will review any incoming pull requests. See the issues tab for todo items.
FAQs
EARLY BETA. Node.js connector for gate.io REST APIs and WebSockets, with TypeScript & end-to-end tests.
The npm package kucoin-api-node receives a total of 4 weekly downloads. As such, kucoin-api-node popularity was classified as not popular.
We found that kucoin-api-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.