
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
package-deu1
Advanced tools
Solauto is a program on the Solana blockchain that lets you manage leveraged longs & shorts on auto-pilot to maximize your gains and eliminate the risk of liquidation. The typescript SDK is made for interacting with the Solauto program. This SDK provides tools for managing, & reading Solauto state data, as well as executing transactions.
import { PublicKey } from "@solana/web3.js";
import { NATIVE_MINT } from "@solana/spl-token";
import * as solauto from "@haven-fi/solauto-sdk";
// Create new Solauto client
const client = solauto.getClient(solauto.LendingPlatform.MARGINFI, {
signer: yourSigner,
rpcUrl: "[YOUR_RPC_URL]",
});
// Initialize the client
const supplyMint = NATIVE_MINT;
const debtMint = new PublicKey(solauto.USDC);
await client.initializeNewSolautoPosition({
positionId: 1,
lpPoolAccount: solauto.getMarginfiAccounts().defaultGroup,
supplyMint,
debtMint,
});
// Open a position with custom settings
const [maxLtvBps, liqThresholdBps] =
await client.pos.maxLtvAndLiqThresholdBps();
const settings: solauto.SolautoSettingsParametersInpArgs = {
boostToBps: solauto.maxBoostToBps(maxLtvBps, liqThresholdBps),
boostGap: 50,
repayToBps: solauto.maxRepayToBps(maxLtvBps, liqThresholdBps),
repayGap: 50,
};
const supplyUsdToDeposit = 100;
const debtUsdToBorrow = 60;
const [supplyPrice, debtPrice] = await solauto.fetchTokenPrices([
supplyMint,
debtMint,
]);
const transactionItems = [
// Open position
solauto.openSolautoPosition(client, settings),
// Deposit supply (SOL) transaction
solauto.deposit(
client,
toBaseUnit(
supplyUsdToDeposit / supplyPrice,
client.pos.supplyMintInfo.decimals
)
),
// Borrow debt (USDC) transaction
solauto.borrow(
client,
toBaseUnit(debtUsdToBorrow / debtPrice, client.pos.debtMintInfo.decimals)
),
// Rebalance to 0 LTV (repays all debt using collateral)
solauto.rebalance(client, 0),
// Withdraw remaining supply in position
solauto.withdraw(client, "All"),
// Close position
solauto.closeSolautoPosition(client),
];
// Send all transactions atomically
const txManager = await new solauto.ClientTransactionsManager({
txHandler: client,
});
const statuses = txManager.send(transactionItems);
import * as solauto from "@haven-fi/solauto-sdk";
// Create new Solauto client
const client = solauto.getClient(solauto.LendingPlatform.MARGINFI, {
signer: yourSigner,
rpcUrl: "[YOUR_RPC_URL]",
});
// Initialize the client
await client.initializeExistingSolautoPosition({
positionId: myPositionId,
});
const transactionItems = [
solauto.rebalance(
client,
undefined // Provide target liquidation utilization rate if you want a specific LTV, otherwise it will rebalance according to position's settings (default)
),
];
const txManager = await new solauto.ClientTransactionsManager({
txHandler: client,
});
const statuses = txManager.send(transactionItems);
FAQs
Typescript SDK for the Test Package
The npm package package-deu1 receives a total of 0 weekly downloads. As such, package-deu1 popularity was classified as not popular.
We found that package-deu1 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.