Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/ntanwir10/go-twitter-api
This project is designed to help users understand how to authenticate with the Twitter API using OAuth and perform two key operations: posting a tweet and deleting a tweet programmatically. It demonstrates how to work with REST APIs, secure credentials using environment variables, and handle API responses and errors.
.
├── main.go # Main Go file that interacts with Twitter API
├── .env # Stores environment variables (should not be committed)
├── go.mod # Go module file
├── go.sum # Dependency management file
└── README.md # Project documentation
statuses/update
endpoint.statuses/destroy
endpoint.After creating an app, navigate to Projects & Apps
→ Your App
→ Keys and Tokens
.
Generate the following keys:
TWITTER_CONSUMER_KEY
)TWITTER_CONSUMER_SECRET
)Access Token
Access Token Secret
These credentials are needed to authenticate your Go application with Twitter's API.
To securely store your API keys and tokens for local development, use a .env
file.
Create a .env
file in the root of your project directory:
touch .env
Add the following lines to the .env
file, replacing the values with your actual keys and tokens:
TWITTER_CONSUMER_KEY=your-consumer-key
TWITTER_CONSUMER_SECRET=your-consumer-secret
TWITTER_ACCESS_TOKEN=your-access-token
TWITTER_ACCESS_SECRET=your-access-secret
Install the Go package godotenv
to load these variables:
go get github.com/joho/godotenv
Then, load the environment variables in your Go code with the following:
err := godotenv.Load()
if err != nil {
log.Fatal("Error loading .env file")
}
When deploying the project or running it in production, you can store your API keys and tokens securely in GitHub Secrets:
Settings
→ Secrets and variables
→ Actions
→ New repository secret
.These secrets can be accessed securely in your GitHub Actions workflow for CI/CD.
Clone the repository:
git clone https://github.com/your-username/twitter-api-go.git
cd twitter-api-go
Install dependencies: Run this command to download the required Go modules:
go mod tidy
Set up environment variables: If not using .env
, ensure your environment variables are set properly:
export TWITTER_CONSUMER_KEY=your-consumer-key
export TWITTER_CONSUMER_SECRET=your-consumer-secret
export TWITTER_ACCESS_TOKEN=your-access-token
export TWITTER_ACCESS_SECRET=your-access-secret
Run the application: To post a tweet and then delete it, run:
go run main.go
The program will post a tweet with "Hello from Twitter API using Go!"
and delete it afterward.
statuses/update
postTweet("Hello from Twitter API using Go!")
statuses/destroy/:id
deleteTweet(tweetID)
The program has robust error handling in place. It captures the following errors:
To manually test the Twitter API, you can run the program in two parts:
postTweet
function.deleteTweet
function to delete it.Post Tweet Response:
{
"created_at": "Fri Oct 13 16:29:29 +0000 2024",
"id": 145334567890123456,
"text": "Hello from Twitter API using Go!"
}
Delete Tweet Response:
{
"created_at": "Fri Oct 13 16:29:29 +0000 2024",
"id": 145334567890123456,
"text": "Hello from Twitter API using Go!",
"deleted": true
}
.env
file.FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.