
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
@candlefinance/push
Advanced tools
yarn add @candlefinance/push
The motivation to write this came from the unmaintained and outdated libraries that exist today. This implementation is written in Swift in less than 200 lines of code.
Android support is coming soon. Check out #1 if you want to help.
AppDelegate.swift to handle push check the example app here for an example..mm|.m|.h), create a new AppDelegate.swift file and bridging header, then delete the Objective-C AppDelegate and main.m file. Finally, copy the contents of the example app's AppDelegate.swift and bridge header to your project.iOS 15 or later.UNUserNotificationCenterDelegate set in AppDelegate.google-services.json in android/app directory from Firebase console.import type { PushNotificationPermissionStatus } from '@candlefinance/push';
import { module as Push } from '@candlefinance/push';
// Shows dialog to request permission to send push notifications, gets APNS token
const isGranted = await push.requestPermissions();
// Get the APNS token w/o showing permission, useful if you want silent push notifications
push.registerForToken();
// Check permission status: 'granted', 'denied', or 'notDetermined'
const status = await push.getAuthorizationStatus();
// Listeners
React.useEffect(() => {
const { NativeEvent, NativeHeadlessTaskKey } = Push.getConstants();
console.log(NativeEvent, NativeHeadlessTaskKey);
Push.addTokenEventListener(NativeEvent.TOKEN_RECEIVED, (token) => {
console.log('TOKEN_RECEIVED:', token);
});
Push.addMessageEventListener(
NativeEvent.BACKGROUND_MESSAGE_RECEIVED,
(message, id) => {
console.log('BACKGROUND_MESSAGE_RECEIVED:', message);
if (id !== undefined) {
console.log('Completing notification:', id);
Push.completeNotification(id);
}
}
);
Push.addErrorListener(NativeEvent.FAILED_TO_REGISTER, (message) => {
console.log('FAILED_TO_REGISTER:', message);
});
Push.addMessageEventListener(NativeEvent.NOTIFICATION_OPENED, (message) => {
console.log('NOTIFICATION_OPENED:', message);
});
Push.addMessageEventListener(
NativeEvent.FOREGROUND_MESSAGE_RECEIVED,
(message) => {
console.log('FOREGROUND_MESSAGE_RECEIVED:', message);
}
);
Push.addMessageEventListener(
NativeEvent.LAUNCH_NOTIFICATION_OPENED,
(message) => {
console.log('LAUNCH_NOTIFICATION_OPENED:', message);
}
);
return () => {
Push.removeListeners(NativeEvent.TOKEN_RECEIVED);
Push.removeListeners(NativeEvent.BACKGROUND_MESSAGE_RECEIVED);
Push.removeListeners(NativeEvent.NOTIFICATION_OPENED);
Push.removeListeners(NativeEvent.FOREGROUND_MESSAGE_RECEIVED);
Push.removeListeners(NativeEvent.LAUNCH_NOTIFICATION_OPENED);
};
}, []);
If you run the example app, you can test push notifications by running the following command:
yarn push
This will use the payload.json file to send a push notification to the device. You can modify the payload to test different scenarios.
Apple also has a new console to test push notifications. If you print out the token from deviceTokenReceived listener, you can use it to send a push notification from the console.
If you're using AWS SNS, you can use the following code to send a push notification
const message = // apns
os === 'ios' ? JSON.stringify({ APNS: JSON.stringify(payload) })
: // fcm
JSON.stringify({
GCM: JSON.stringify({
data: {
title: title,
body: body,
custom: customData,
data: customData,
priority: '1',
imageUrl:
'https://logo.png',
targetClass: 'com.yourapp.candle.MainActivity',
},
})
})
We are open to contributions. Please read our Contributing Guide for more information.
This project is licensed under the terms of the MIT license.
Post in #oss channel in our Discord if you have any questions or want to contribute.
FAQs
Gary Tokman
We found that @candlefinance/push demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.