
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
rwagenthub-sdk
Advanced tools
JS SDK for AgentHub — call 32 AI APIs with automatic USDC payment on Base via x402
JS SDK for AgentHub — call 24 AI APIs with automatic USDC micropayment on Base via the x402 protocol.
No subscriptions. No API keys. Your wallet pays per call.
npm install rwagenthub-sdk
Requires Node ≥ 22. You'll need a wallet with USDC on Base Mainnet.
import { AgentHub } from "rwagenthub-sdk";
const hub = new AgentHub({ privateKey: process.env.WALLET_PRIVATE_KEY });
// Execute any API — payment handled automatically
const result = await hub.call("stock_quote", { symbol: "NVDA" });
console.log(result.price); // 134.20
// Check price before calling (free, no payment)
const { price_usd } = await hub.estimate("flight_search");
console.log(price_usd); // 0.01
// List all available APIs with prices (free)
const { apis } = await hub.listApis();
// Get JSON Schema for any API (free)
const schema = await hub.schema("weather_forecast");
new AgentHub({ privateKey, gateway? })
| Option | Type | Required | Description |
|---|---|---|---|
privateKey | string | yes | Private key of a Base Mainnet wallet with USDC (0x...) |
gateway | string | no | Gateway base URL (defaults to the hosted instance) |
hub.call(api, inputs) → Promise<object>Calls an API and returns the data field directly. Payment is handled transparently via x402. Throws on payment failure or API error.
const weather = await hub.call("weather_forecast", { location: "Tokyo", days: 3 });
const flights = await hub.call("flight_search", { from: "JFK", to: "LAX", date: "2026-06-01" });
const prices = await hub.call("crypto_price", { coins: "btc,eth,sol" });
hub.estimate(api) → Promise<{ success, api, price_usd }>Returns the cost of an API call without executing it. Free — no payment required.
hub.listApis() → Promise<{ apis }>Lists all 24 available APIs with their names and prices. Free.
hub.schema(api?) → Promise<object>Returns the JSON Schema (inputs + outputs) for one API or all APIs. Free.
| API | Description | Price |
|---|---|---|
flight_search | One-way flight search | $0.01 |
flight_status | Real-time flight status | $0.01 |
seat_map | Seat map for a flight offer | $0.01 |
airport_search | Airport lookup by name/IATA | $0.01 |
hotel_search | Hotels by city and dates | $0.06 |
activities_search | Tours and experiences by GPS | $0.01 |
web_search | Google web/news search | $0.02 |
web_search_ai | AI-optimized semantic search | $0.02 |
places_search | Local businesses and POIs | $0.02 |
image_search | Google image search | $0.01 |
shopping_search | Google Shopping results | $0.02 |
url_extract | Fetch URL as clean Markdown | $0.02 |
weather_forecast | 15-day forecast via Visual Crossing | $0.01 |
crypto_price | Real-time crypto prices | $0.01 |
exchange_rate | Forex rates for 160+ currencies | $0.01 |
defi_market_snapshot | DeFi TVL, DEX volume, top protocols | $0.02 |
defi_yields | Best yield farming pools | $0.02 |
stock_quote | Real-time stock quote | $0.01 |
stock_profile | Company profile and market cap | $0.01 |
stock_search | Symbol search by company name | $0.01 |
market_news | Financial news by symbol or category | $0.01 |
earnings_calendar | Upcoming earnings announcements | $0.01 |
email_send | Send transactional email via Resend | $0.01 |
code_exec | Execute code in isolated sandbox | $0.05 |
MIT
FAQs
JS SDK for AgentHub — call 32 AI APIs with automatic USDC payment on Base via x402
We found that rwagenthub-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.