
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@agree-able/invite
Advanced tools
A utility for loading and configuring room settings with support for invites, domain-based configuration, and identity verification through Keybase.
npm install @agree-able/invite
import { load } from '@agree-able/invite'
// Simple usage with direct invite
const config = { invite: 'your-invite-code' }
const result = await load(config, confirmEnterRoom)
// Domain-based configuration with DID lookup
const config = {
domain: 'example.com',
loadDid: true
}
const result = await load(config, confirmEnterRoom)
// With Keybase verification
const config = {
domain: 'example.com',
keybaseUsername: 'username',
privateKeyArmored: 'your-pgp-key'
}
const result = await load(config, confirmEnterRoom)
The confirmEnterRoom
function is required and must handle room entry expectations. It receives room expectations and host details, and should return an acceptance object.
const confirmEnterRoom = async (expectations, hostDetails) => {
// expectations contains room requirements
// hostDetails may contain verification details if whoami is enabled
console.log('room rules', expectations.rules)
console.log('room reason', expectations.reason)
// Example of checking whoami verification
if (hostDetails?.whoami?.keybase) {
const { verified, username } = hostDetails.whoami.keybase
if (!verified) {
throw new Error(`Keybase verification failed for ${username}`)
}
}
// you must return the acceptance object back to the server
return {
reason: true, // 'agree to the reason for the room'
rules: true // 'agree to the rules for the room'
}
}
The load
function accepts a configuration object with the following options:
invite
: Direct invite code (z32 string)domain
: Domain to lookup breakout room key fromloadDid
: Whether to load DID from domainhostProveWhoami
: Enable host whoami verificationkeybaseUsername
: Keybase username for verificationprivateKeyArmoredFile
: File location of PGP private keyprivateKeyArmored
: PGP private key in armored formatThe function returns a Promise resolving to an object containing:
invite
: The room invite codedid
: The DID (if requested and available)MIT
FAQs
simple ways to get an invite to a room
The npm package @agree-able/invite receives a total of 5 weekly downloads. As such, @agree-able/invite popularity was classified as not popular.
We found that @agree-able/invite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.