
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
defi
Advanced tools
pip install defi
import defi.defi_tools as dft
# Impermanent loss for stableCoin & -20% return token
dft.iloss(0.8)
-0.62%
import defi.defi_tools as dft
# Impermanent loss for stableCoin & +60% return token
dft.iloss(1.6, numerical=True)
0.027 # Same as 2.7%
import defi.defi_tools as dft
# Exercise: Get returns after 20 days, assuming token A is a stablecoin, token B perform + 150%
# individual staking pools for both = 0.01% & 0.05% daily
# liquidity-pool farming rewards =0.2% daily & Earn by fees/day = 0.01%
dft.compare(days=20, var_A=0, var_B=150, rw_pool_A=0.01, rw_pool_B=0.05, rw_pool_AB=0.2, fees_AB=0.01)
{
"buy_hold": "75.00%",
"stake": "75.60%",
"farm": "71.96%",
"Best": "Stake"
}
import defi.defi_tools as dft
metadata, df = dft.getProtocol('Uniswap')
metadata
{
"id": "1",
"name": "Uniswap",
"address": "0x1f9840a85d5af5bf1d1762f925bdaddc4201f984",
"symbol": "UNI",
"url": "https://info.uniswap.org/",
"description": "A fully decentralized protocol for automated liquidity provision on Ethereum.\r\n",
"chain": "Ethereum",
"logo": "None",
"audits": "2",
"audit_note": "None",
"gecko_id": "uniswap",
"cmcId": "7083",
"category": "Dexes",
"chains": ["Ethereum"],
"module": "uniswap.js"
}
import defi.defi_tools as dft
import matplotlib.pyplot as plt
df = dft.getProtocols()
fig, ax = plt.subplots(figsize=(12,6))
n = 50 # quantity to show
top = df.sort_values('tvl', ascending=False).head(n)
chains = top.groupby('chain').size().index.values.tolist()
for chain in chains:
filtro = top.loc[top.chain==chain]
ax.bar(filtro.index, filtro.tvl, label=chain)
ax.set_title(f'Top {n} dApp TVL, groupBy dApp main Chain', fontsize=14)
ax.grid(alpha=0.5)
plt.legend()
plt.xticks(rotation=90)
plt.show()
import defi.defi_tools as dft
import pandas as pd
exchanges = ['pancakeswap', 'curve', 'makerdao', 'uniswap','Compound', 'AAVE','sushiswap','anchor']
hist = [dft.getProtocol(exchange)[1] for exchange in exchanges]
df = pd.concat(hist, axis=1)
df.columns = exchanges
df.plot(figsize=(12,6))
Endpoints available, some examples:
* dft.getGeckoIDs()
# coinGecko first 5000 ids
* dft.geckoPrice("bitcoin,ethereum", "usd,eur,brl")
# coinGecko quotes
* dft.geckoList(page=1, per_page=250)
# full coinGecko cyptocurrency list
* dft.geckoMarkets("ethereum")
# top 100 liquidity markets, prices, and more, for eth or other coin
* dft.geckoHistorical('cardano')
# full history containing price, market cap and volume
* dft.farmSimulate(['huobi-token','tether'], apr=45)
# Simulate farming strategy with apr=45%
import defi.defi_tools as dft
ids = dft.getGeckoIDs()
ids[:10]
['bitcoin', 'ethereum', 'binancecoin', 'tether', 'solana', 'cardano', 'ripple', 'polkadot', 'shiba-inu', 'dogecoin']
import defi.defi_tools as dft
dft.geckoPrice("bitcoin,ethereum", "usd,eur,brl")
{"ethereum": {"usd": 2149.85, "eur": 1807.58, "brl": 12208.77},
"bitcoin": {"usd": 60188, "eur": 50606, "brl": 341802}}
import defi.defi_tools as dft
df = dft.geckoMarkets("ethereum")
print(df.info())
# returns top 100 ethereum quotes by volume
Index: 100 entries, IDCM to FTX.US
Data columns (total 9 columns):
# Column Non-Null Count Dtype
--- ------ -------------- -----
0 base 100 non-null object
1 target 100 non-null object
2 last 100 non-null float64
3 volume 100 non-null float64
4 spread 100 non-null float64
5 timestamp 100 non-null datetime64[ns, UTC]
6 volume_usd 100 non-null float64
7 price_usd 100 non-null float64
8 trust_score 100 non-null object
dtypes: datetime64[ns, UTC](1), float64(5), object(3)
memory usage: 7.8+ KB
import defi.defi_tools as dft
df = dft.geckoHistorical('cardano')
print(df)
price market_caps total_volumes date 2017-10-18 00:00:00 0.026845 6.960214e+08 2.351678e+06 2017-10-19 00:00:00 0.026830 6.956220e+08 2.815156e+06 2017-10-20 00:00:00 0.030300 7.855800e+08 8.883473e+06 2017-10-21 00:00:00 0.028588 7.412021e+08 5.308857e+06 2017-10-22 00:00:00 0.027796 7.206698e+08 2.901876e+06 ... ... ... ... 2021-04-13 00:00:00 1.319790 4.223483e+10 5.005258e+09 2021-04-14 00:00:00 1.422447 4.565529e+10 5.693373e+09 2021-04-15 00:00:00 1.456105 4.676570e+10 8.920293e+09 2021-04-16 00:00:00 1.478071 4.730118e+10 5.151595e+09 2021-04-17 03:47:55 1.433489 4.595961e+10 5.152747e+09 [1278 rows x 3 columns]
import defi.defi_tools as dft
pair = ['huobi-token','tether']
apr = 45
dft.farmSimulate(pair, apr, start='2021-01-01')
Downloading huobi-token
Downloading tether
{'Token 1': 'huobi-token',
'Token 2': 'tether',
'start': '2021-01-01',
'fixed APR': '45%',
'Buy & Hold': '68.90%',
'Impermanent Loss': '-8.66%',
'Farming Rewards': '75.45%',
'Farming + Rewards - IL': '153.02%'}
import defi.defi_tools as dft
df = dft.pcsTokens()
print(df)
name symbol price price_BNB updated
0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82 PancakeSwap Token Cake 24.0636 0.0450 2021-04-17 04:29:08.332
0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c Wrapped BNB WBNB 534.2575 1.0000 2021-04-17 04:29:08.332
0x0F9E4D49f25de22c2202aF916B681FBB3790497B Perlin PRL 0.2091 0.0004 2021-04-17 04:29:08.332
0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56 BUSD Token BUSD 1.0000 0.0019 2021-04-17 04:29:08.332
0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c BTCB Token BTCB 62166.5517 116.3604 2021-04-17 04:29:08.332
... ... ... ... ... ...
0xB6802C06A441BA63624751C53C7c0708b75F06EC FinalMoon FINALMOON 0.0651 0.0001 2021-04-17 04:29:08.332
0x2cF0DA1EB4165d73156CE1E32450e4A0E1c1791b FairUnicorn FUni 0.0000 0.0000 2021-04-17 04:29:08.332
0x5CeD26185f82B07E1516d0B013c54CcBD252A4Ad Peaches PEACH 0.1130 0.0002 2021-04-17 04:29:08.332
0x2bA64EFB7A4Ec8983E22A49c81fa216AC33f383A Wrapped BGL WBGL 0.1000 0.0002 2021-04-17 04:29:08.332
0x019bE1796178516e060072004F267B59a49A0801 Pepper Finance PEPR 0.1819 0.0003 2021-04-17 04:29:08.332
[854 rows x 5 columns]
import defi.defi_tools as dft
pairs = dft.pcsPairs(as_df=False)
print(pairs)
{"updated_at": 1618645355351,
"data": {"0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82_0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c":
{"pair_address": "0xA527a61703D82139F8a06Bc30097cC9CAA2df5A6",
"base_name": "PancakeSwap Token",
"base_symbol": "Cake",
"base_address": "0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82",
"quote_name": "Wrapped BNB",
"quote_symbol": "WBNB",
"quote_address": "0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c",
"price": "0.04503969270521829587",
"base_volume": "5473068.824002232134035221",
"quote_volume": "239997.1228321299572591638",
"liquidity": "1076144814.0632013827775993748053",
"liquidity_BNB": "2007551.221740467021401314"
},
}
import defi.defi_tools as dft
dft.pcsTokenInfo('cake')
{"name": "PancakeSwap Token",
"symbol": "Cake",
"price": "24.03353223898417117634582253598019",
"price_BNB": "0.04503467915973850237292527741402623"
}
import defi.defi_tools as dft
dft.pcsPairInfo('cake','bnb')
{"pair_address": "0xA527a61703D82139F8a06Bc30097cC9CAA2df5A6",
"base_name": "PancakeSwap Token",
"base_symbol": "Cake",
"base_address": "0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82",
"quote_name": "Wrapped BNB",
"quote_symbol": "WBNB",
"quote_address": "0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c",
"price": "0.04503969270521829587",
"base_volume": "5473068.824002232134035221",
"quote_volume": "239997.1228321299572591638",
"liquidity": "1076144814.0632013827775993748053",
"liquidity_BNB": "2007551.221740467021401314"
}
import defi.defi_tools as dft
dft.value_f, iloss = dft.iloss_simulate('cake','bnb', value=1000, base_pct_chg=50, quote_pct_chg=-25)
FAQs
Unknown package
We found that defi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.