
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
github.com/FrankCheungDev/dingtalk-stream-sdk-go
Advanced tools
Go SDK for DingTalk Stream Mode API, Compared with the webhook mode, it is easier to access the DingTalk chatbot
钉钉支持 Stream 模式接入事件推送、机器人收消息以及卡片回调,该 SDK 实现了 Stream 模式。相比 Webhook 模式,Stream 模式可以更简单的接入各类事件和回调。
1、创建企业内部应用
进入钉钉开发者后台,创建企业内部应用,获取ClientID(即 AppKey)和ClientSecret( 即AppSecret)。
发布应用:在开发者后台左侧导航中,点击“版本管理与发布”,点击“确认发布”,并在接下来的可见范围设置中,选择“全部员工”,或者按需选择部分员工。
2、Stream 模式的机器人(可选)
如果不需要使用机器人功能的话,可以不用创建。
在应用管理的左侧导航中,选择“消息推送”,打开机器人能力,设置机器人基本信息。
注意:消息接收模式中,选择 “Stream 模式”

点击“点击调试”按钮,可以创建测试群进行测试。
3、启动应用
修改参数,启动应用
go run example/*.go -client_id "your-client-id" -client_secret "your-client-secret"
测试效果:

进入钉钉开发者后台,选择企业内部应用,在应用管理的左侧导航中,选择“事件与回调”。 “订阅管理”中,“推送方式”选项中,选择 “Stream 模式”,并保存
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.