
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@buttercup/google-oauth2-client
Advanced tools
Minimal compatibility-first Google OAuth2 client implementation
This library is a minimal implementation of the google-auth-library project, designed to be compatible with NodeJS, the browser and React Native. The google-auth-library package has had problems with compatibility in this regard and rather than wait for that to get sorted, this library was released to solve the exact problem without the overhead of project politics, wait times and package excess (extra features not needed that are causing the incompatibilities in the first place).
This library is targeted at NodeJS but should work everywhere.
Install by running npm install @buttercup/google-oauth2-client --save.
Import the OAuth2Client class to get started, similarly to the original implemenation:
import { OAuth2Client } from "@buttercup/google-oauth2-client";
const client = new OAuth2Client(
"my-client-id",
"my-client-secret",
"http://redirect.uri"
);
const authURL = client.generateAuthUrl(/* ... */);
The following methods are implemented:
| Method | Example | Description |
|---|---|---|
generateAuthUrl | generateAuthUrl({ access_type: "offline", prompt: "consent", scope: "profile" }) | Generate an authorisation URL |
exchangeAuthCodeForToken | await exchangeAuthCodeForToken(authCode) | Get the tokens for an authorisation code |
refreshAccessToken | await refreshAccessToken(refreshToken) | Refresh the tokens |
FAQs
Google OAuth2 authentication client
We found that @buttercup/google-oauth2-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.