
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
opensea-offer-maker
Advanced tools
A command-line tool for creating and managing offers on OpenSea. Supports multiple chains (Ethereum, Base, Sepolia).
git clone https://github.com/yourusername/opensea-offer-maker.git
cd opensea-offer-maker
npm install
.env file in the root directory:OPENSEA_API_KEY=your_api_key
ALCHEMY_API_KEY=your_alchemy_api_key
# Initialize your private key (will be encrypted)
node src/cli.js key setup
# Verify your key setup
node src/cli.js key test
The private key will be encrypted and stored locally. You can also use a temporary private key for one-time operations:
node src/cli.js send -t eth --private-key 0xYourPrivateKey ...
# Add a new private key with a name
node src/cli.js key add my-key
# List all stored keys
node src/cli.js key list
# Switch active key
node src/cli.js key use my-key
# Remove a stored key
node src/cli.js key remove my-key
# Test key decryption
node src/cli.js key test
# Use temporary private key for any command
--private-key <key>
# View current offers for a collection
node src/cli.js check -c collection_slug
# View offers on specific chain
node src/cli.js check -c collection_slug --chain ethereum
# Create a collection offer
node src/cli.js offer -c collection_slug -o 0.0001 -e 15
# Create an individual NFT offer
node src/cli.js offer -a contract_address -t token_id -o 0.0001 -e 15
# Create offer on specific chain
node src/cli.js offer -c collection_slug -o 0.0001 --chain base
# Automatically create collection offers
node src/cli.js auto collection -c collection_slug --min 0.01 --max 0.035 --increment 0.0001 --interval 30 --floor-percentage 80
# Automatically create individual token offers
node src/cli.js auto token -a contract_address -t token_id -c collection_slug --min 0.01 --max 0.035 --increment 0.0001 --interval 30 --floor-percentage 80
# Auto bidding on specific chain
node src/cli.js auto collection -c collection_slug --min 0.01 --max 0.035 --chain ethereum
# Send ETH
node src/cli.js send -t eth -a 0.1 -r recipient_address
# Send WETH
node src/cli.js send -t weth -a 0.1 -r recipient_address
# Convert ETH to WETH
node src/cli.js swap -a 0.1 -d eth2weth
# Convert WETH to ETH
node src/cli.js swap -a 0.1 -d weth2eth
# List NFT on multiple marketplaces
node src/cli.js list -a contract_address -t token_id -p 0.1 --marketplaces opensea,blur
# List with floor price difference
node src/cli.js list -a contract_address -t token_id --floor-diff +10% --marketplaces all
# List with specific expiration
node src/cli.js list -a contract_address -t token_id -p 0.1 -e 7d --marketplaces opensea,blur
Supported marketplaces:
# Check current offers for a collection on Base
node src/cli.js check -c scribblebears --chain base
# Create a collection offer for 0.1 WETH
node src/cli.js offer -c scribblebears -o 0.1 -e 60 --chain base
# Create auto collection offers with floor price limit
node src/cli.js auto collection -c scribblebears --min 0.01 --max 0.035 --floor-percentage 80 --chain base
# Create auto token offers with floor price limit
node src/cli.js auto token -a 0xf3ec2d6394fc899a5dc1823a205670ebb30939cc -t 0 -c scribblebears --min 0.01 --max 0.035 --floor-percentage 80 --chain base
Add --debug to any command for detailed logging:
node src/cli.js key setup --debug
MIT
FAQs
CLI tool for making NFT offers on OpenSea and Blur
We found that opensea-offer-maker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.