
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
slp-light is a lightweight library for creating a slp-token transaction. It has few exposed methods to make sure it is as easy as possible to create a token transaction, hiding all complexity from the user.
npm install slp-light
To fetch utxos use the method retrieveUtxos() which lets the user select the source of the utxos. Here is an
example using public available apis from Bitcoin.com.
Using BitcoinComRetrieverImpl
import { Utxo } from './src/Utxo';
import { retrieveBchUtxos, retrieveSlpUtxos } from './src/index';
import { BitcoinComBchRetriever, BitcoinComSlpRetriever } from './src/facade/bitcoincom/';
let bch: Utxo[] = await retrieveBchUtxos({cashAddress: "bitcoincash:qzm4u38umtw6ak4was24r6ucerkzzxqr5s2328xm0r", wif: "WIF"}, new BitcoinComBchRetriever());
let slp: Utxo[] = await retrieveSlpUtxos({cashAddress: "bitcoincash:qzm4u38umtw6ak4was24r6ucerkzzxqr5s2328xm0r", wif: "WIF"}, new BitcoinComSlpRetriever());
Using custom UtxoRetrieverFacade. When using a custom retriever make sure the source only allows valid slp-transactions. Since the library
does not have its own validation it relies on the utxo source for validation.
import { retrieveBchUtxos, retrieveSlpUtxos } from './src/index';
import {Address, Utxo } from './src/Utxo';
import { BchUtxoRetrieverFacade } from './src/facade/UtxoRetrieverFacade';
const retriever: BchUtxoRetrieverFacade = {
getBchUtxosFromAddress(address: Address): Promise<Utxo[]> {
// Custom utxo retriever code goes here
return Promise.resolve([]);
}
}
const utxos: Utxo[] = await retrieveBchUtxos({cashAddress: "bitcoincash:qzm4u38umtw6ak4was24r6ucerkzzxqr5s2328xm0r", wif: "WIF"}, retriever);
import { selectUtxos } from './src/index';
import { SelectedUtxos } from './src/index';
import BigNumber from 'bignumber.js';
import {Utxo } from './src/Utxo';
const utxos: Utxo[] = [];
const selectUtxo: SelectedUtxos = selectUtxos(new BigNumber("5"), "323437d4c86b00874c3b00cd454ab6ffb3226130fde09747009cf270caedddcf", utxos);
import { createRawTx } from './src/index';
import BigNumber from 'bignumber.js';
import { SelectedUtxos } from './src/utxo';
const mySelectedUtxos: SelectedUtxos = null;
const rawTx = createRawTx(new BigNumber("5"), "dcf128f7f836f369d339963685e91b105cf7982d8977d09f6a776329a6e290e7",
"bitcoincash:qrve2j5h2f8hy9hlptu7ejltzf4m7fwees60qss5f4",
"bitcoincash:qzm4u38umtw6ak4was24r6ucerkzzxqr5s2328xm0r",
mySelectedUtxos);
You can either use one of the premade broadcasting facades implementing the interface or implement your own as shown below.
import { broadcastTransaction } from './src/index';
import { BroadcastFacade } from './src/facade/BroadcastFacade';
const broadcastFacade: BroadcastFacade = {
broadcastTransaction(raw: string): Promise<string> {
return Promise.resolve('BROADCAST REQUEST GOES HERE');
}
}
const rawTx = broadcastTransaction("TX_RAW", broadcastFacade);
If you just want to broadcast a transaction using Bitcoin.com apis then you can use
the simpleSend() function from simple.ts. This method is an abstraction on top of the other methods for simplicity.
If you want more control use the other methods in combination with each other.
import { simpleSend } from './src/simple';
import BigNumber from 'bignumber.js';
const txId = await simpleSend("Kzm1oz8sLSvuQLEgu99xixSkhNj7kyBZe6TpqTfdgKGhXUeSLSR",
"simpleledger:qp2mdqc4r8ylsrnu9f4j5xu8r47m722f6uyfsz4zr6",
"323437d4c86b00874c3b00cd454ab6ffb3226130fde09747009cf270caedddcf",
new BigNumber(300));
npm run build
npm run test:npx
FAQs
Lightweight slp-library
We found that slp-light demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.