
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@axolo/node-dingtalk
Advanced tools
Dingtalk OpenAPI Node.js SDK.
yarn add @axolo/node-dingtalk
params
| config | required | default | description |
|---|---|---|---|
| appMode | corp | corp = corp internal app, isv = isv app | |
| appType | eapp | eapp = mini app, h5 = web app | |
| agentId | true | agentId | |
| appKey | true | appKey | |
| appSecret | true | appSecret |
| config | required | default | description |
|---|---|---|---|
| appMode | isv | corp | corp = corp internal app, isv = isv app |
| appType | eapp | eapp = mini app, h5 = web app | |
| appId | true | appId | |
| suiteId | true | dingtalk cloud push set suiteTicket | |
| suiteKey | true | suiteKey | |
| suiteSecret | true | suiteSecret | |
| eventToken | true | http event callback encrypt token | |
| eventAesKey | true | http event callback encrypt aesKey |
| config | description |
|---|---|
| axios | HTTP Client, use axios |
| cacheManager | cache, use cache-manager |
| cache | cache setting |
| baseUrl | base url of Dingtalk OpenAPI |
| corpAppAuthTokenUrl | get access token url of corp app |
| isvAppAuthTokenUrl | get access token url of isv app |
| isvAppAuthInfoUrl | get auth info url |
| isvAppAgentUrl | get agent info url |
return
A instance of Dingtalk OpenAPI Node.js SDK.
more request options see axios.
params
| parmas | description |
|---|---|
| api | querystring, Dingtalk OpenAPI |
| request.method | HTTP Method |
| request.params | HTTP querystring as Object by GET |
| request.body | HTTP body as Object by POST/PATCH/PUT |
| scope.corpId | to get accessToken per corp of isv app |
return
Get data or throw dingtalk error from Dingtalk OpenAPI.
See http event callback for help. This method use as middleware usualy.
params
| params | description |
|---|---|
| signature | signature string |
| timestamp | timestamp string |
| nonce | nonce string |
| encrypt | encrypt string |
return
event decrypted of callback.
and response is encrypted response for callback success.
const DingtalkSdk = require('@axolo/node-dingtalk');
const config = {
agentId: 'AGENT_ID',
appKey: 'APP_KEY',
appSecret: 'APP_SECRET',
};
const dingtalkSdk = new DingtalkSdk(config);
const request = {
url: '/user/getuserinfo',
body: { code: 'authcode' },
};
dingtalk
.execute(request)
.catch(err => console.log(err))
.then(res => console.log(res));
yarn test ./test/config.test.js # test config
yarn test ./test/execute.test.js # test execute
TIP: Please create .env and .env.test in project root before test.
for corp app
agentId = AGENT_ID
appKey = APP_KEY
appSecret = APP_SECRET
for isv app
appMode = isv
appType = h5
appId = APP_ID
# suiteId is required of Dingtalk Cloud Push
suiteId = SUITE_ID
suiteKey = SUITE_KEY
suiteSecret = SUITE_SECRET
# eventToken and eventAesKey is required of HTTP Event Callback
eventToken = EVENT_TOKEN
eventAesKey = EVENT_AES_KEY
## http server for http event callback
httpPort = 7001
## mysql rds for dingtalk cloud push
rdsHost = your.mysql.host
rdsPort = 3306
rdsUser = user
rdsPassword = password
rdsDatabase = ding_cloud_push
# get corpId and appId from dingtalk-jsapi or querystring
corpId = CROP_ID
DingtalkSdkCache, support memory, redis, mysql, etc.DingtalkSdk.event, DingtalkSdk.error.Yueming Fang
FAQs
Dingtalk OpenAPI Node.js SDK.
We found that @axolo/node-dingtalk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.