
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
paymaster-sdk
Advanced tools
SDK for interacting with UniswapPaymaster - pay for transactions with any token via Uniswap V4
A lightweight SDK for interacting with the UniswapPaymaster contract. Pay for transactions with any token using Uniswap V4 liquidity pools.
npm install @uniswap-paymaster/sdk viem
import { createPublicClient, http } from 'viem'
import { privateKeyToAccount } from 'viem/accounts'
import { sepolia } from 'viem/chains'
import { buildPaymasterData } from '@uniswap-paymaster/sdk'
// Setup
const client = createPublicClient({
chain: sepolia,
transport: http(),
})
const account = privateKeyToAccount('0x...')
// Build paymaster data
const paymasterData = await buildPaymasterData(client, account, {
poolKey: {
currency0: '0x0000000000000000000000000000000000000000', // ETH
currency1: '0x...', // Your token address
fee: 3000,
tickSpacing: 60,
hooks: '0x0000000000000000000000000000000000000000',
},
token: '0x...', // Token you're paying with
maxTokenAmount: 1000000n, // Max tokens willing to spend
paymasterAddress: '0x...', // UniswapPaymaster address
permit2Address: '0x000000000022D473030F116dDEE9F6B43aC78BA3',
userAddress: account.address,
})
// Use with viem's account abstraction
// (paymasterData goes into your UserOperation)
buildPaymasterDataBuilds complete paymaster data including Permit2 signature.
async function buildPaymasterData(
client: Client,
account: LocalAccount,
params: {
poolKey: PoolKey
token: Address
maxTokenAmount: bigint
paymasterAddress: Address
permit2Address: Address
userAddress: Address
deadline?: bigint // Optional
nonce?: bigint // Optional, auto-fetched
}
): Promise<Hex>
signPermit2Signs a Permit2 permit using EIP-712.
async function signPermit2(params: {
account: LocalAccount
chainId: number
permit2Address: Address
permit: Permit2Permit
}): Promise<Hex>
getPermit2NonceFetches the current Permit2 nonce for a user.
async function getPermit2Nonce(
client: Client,
params: {
permit2Address: Address
owner: Address
token: Address
spender: Address
}
): Promise<bigint>
type PoolKey = {
currency0: Address // Must be address(0) for ETH
currency1: Address // Your token address
fee: number
tickSpacing: number
hooks: Address
}
type Permit2Permit = {
details: {
token: Address
amount: bigint
expiration: bigint
nonce: bigint
}
spender: Address
sigDeadline: bigint
}
See the examples directory for complete integration examples.
MIT
FAQs
SDK for interacting with UniswapPaymaster - pay for transactions with any token via Uniswap V4
We found that paymaster-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.