
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
xtrader-sdk
Advanced tools
Javascript SDK for the xTrader Blockchain Program on Solana
npm i xtrader-sdk
import xtrader from 'xtrader-sdk';
xtrader.Create
xtrader.Execute
xtrader.Cancel
xtrader.Received
xtrader.Sent
xtrader.Find
xtrader.Fetch
xtrader.Fee
xtrader.Send
xtrader.Status
xtrader.Sns
import { Keypair } from "@solana/web3.js";
const rpc = "https://staked.helius-rpc.com?api-key=YOUR-KEY";
const secret = [1,2,3,4,5,~];
const signer = Keypair.fromSecretKey(new Uint8Array(secret));
const tx = await xtrader.Create({
rpc: rpc,
priority: "Medium", // priority fee level
convert: true, // true because we're passing decimal values below
seller: "7Z3LJB2rxV4LiRBwgwTcufAWxnFTVJpcoCMiCo8Z5Ere",
token1Mint: "Xsc9qvGR1efVDFGLrVsmkzv3qi45LTBjeUKSPmx9qEh",
token1Amount: "0.001",
buyer: "B8owyFUUu46g8Z4JNZMXmLSc2D725zv6fcXuBewGeTyj",
token2Mint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
token2Amount: "0.007",
memo: "", // optional reference also applied to accepted offer tx
});
if(tx.tx){
tx.tx.sign([signer]);
const signature = await xtrader.Send(rpc,tx.tx);
console.log("signature", signature);
console.log("awaiting status...");
const status = await xtrader.Status(rpc,signature);
if(status!="finalized"){console.log(status);}
else{
console.log(status);
const offer = await xtrader.Fetch({
rpc:rpc, display:true, offer:tx.offer
});
console.log(offer);
}
}
else{
console.log(tx);
}
const tx = await xtrader.Cancel({
rpc: rpc,
offer: "2jcih7dUFmEQfMUXQQnL2Fkq9zMqj4jwpHqvRVe3gGLL" // offer id
});
if(typeof tx.status!="undefined"){console.log(tx);}
else{
tx.sign([signer]);
const signature = await xtrader.Send(rpc,tx);
console.log("signature", signature);
console.log("awaiting status...");
const status = await xtrader.Status(rpc,signature);
console.log(status);
}
const tx = await xtrader.Execute({
rpc: rpc,
offer: "3pjxfm25WWwD9BcWSqBFamJKYgEpNAnEz8mEmxk9biBQ",
buyer: "B8owyFUUu46g8Z4JNZMXmLSc2D725zv6fcXuBewGeTyj"
});
if(typeof tx.status!="undefined"){console.log(tx);}
else{
tx.sign([signer]);
const signature = await xtrader.Send(rpc,tx);
console.log("signature", signature);
console.log("awaiting status...");
const status = await xtrader.Status(rpc,signature);
console.log(status);
}
const received = await xtrader.Received({
rpc: rpc,
display: true,
wallet: "B8owyFUUu46g8Z4JNZMXmLSc2D725zv6fcXuBewGeTyj"
});
console.log(received);
const sent = await xtrader.Sent({
rpc: rpc,
display: true,
wallet: "7Z3LJB2rxV4LiRBwgwTcufAWxnFTVJpcoCMiCo8Z5Ere"
});
console.log(sent);
returns an offers's details
const offer = await xtrader.Fetch({
rpc: rpc,
display: true,
offer: "DUjEPTHQsUizXcyfix5iEnxvU6vMxU6EJW4FEHs9Xgrb",
});
console.log(offer);
get the base offer fee
const fee = await xtrader.Fee({
rpc: rpc,
display: true, // true = sol, false = lamports
});
console.log(fee);
FAQs
Javascript SDK for the xTrader Protocol
We found that xtrader-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.