
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@candlefinance/push
Advanced tools
yarn add @candlefinance/push
The motivation to write this came from the unmaintained and outdated libraries that exist today. This implementation is written in Swift in less than 200 lines of code.
Android support is coming soon. Check out #1 if you want to help.
AppDelegate.swift to handle push check the example app here for an example..mm|.m|.h), create a new AppDelegate.swift file and bridging header, then delete the Objective-C AppDelegate and main.m file. Finally, copy the contents of the example app's AppDelegate.swift and bridge header to your project.iOS 15 or later.UNUserNotificationCenterDelegate set in AppDelegate.google-services.json in android/app directory from Firebase console.import type { PushNotificationPermissionStatus } from '@candlefinance/push';
import { module as Push } from '@candlefinance/push';
// Shows dialog to request permission to send push notifications, gets APNS token
const isGranted = await push.requestPermissions();
// Get the APNS token w/o showing permission, useful if you want silent push notifications
push.registerForToken();
// Check permission status: 'granted', 'denied', or 'notDetermined'
const status = await push.getAuthorizationStatus();
// Listeners
React.useEffect(() => {
const { NativeEvent, NativeHeadlessTaskKey } = Push.getConstants();
console.log(NativeEvent, NativeHeadlessTaskKey);
Push.addTokenEventListener(NativeEvent.TOKEN_RECEIVED, (token) => {
console.log('TOKEN_RECEIVED:', token);
});
Push.addMessageEventListener(
NativeEvent.BACKGROUND_MESSAGE_RECEIVED,
(message, id) => {
console.log('BACKGROUND_MESSAGE_RECEIVED:', message);
if (id !== undefined) {
console.log('Completing notification:', id);
Push.completeNotification(id);
}
}
);
Push.addErrorListener(NativeEvent.FAILED_TO_REGISTER, (message) => {
console.log('FAILED_TO_REGISTER:', message);
});
Push.addMessageEventListener(NativeEvent.NOTIFICATION_OPENED, (message) => {
console.log('NOTIFICATION_OPENED:', message);
});
Push.addMessageEventListener(
NativeEvent.FOREGROUND_MESSAGE_RECEIVED,
(message) => {
console.log('FOREGROUND_MESSAGE_RECEIVED:', message);
}
);
Push.addMessageEventListener(
NativeEvent.LAUNCH_NOTIFICATION_OPENED,
(message) => {
console.log('LAUNCH_NOTIFICATION_OPENED:', message);
}
);
return () => {
Push.removeListeners(NativeEvent.TOKEN_RECEIVED);
Push.removeListeners(NativeEvent.BACKGROUND_MESSAGE_RECEIVED);
Push.removeListeners(NativeEvent.NOTIFICATION_OPENED);
Push.removeListeners(NativeEvent.FOREGROUND_MESSAGE_RECEIVED);
Push.removeListeners(NativeEvent.LAUNCH_NOTIFICATION_OPENED);
};
}, []);
If you run the example app, you can test push notifications by running the following command:
yarn push
This will use the payload.json file to send a push notification to the device. You can modify the payload to test different scenarios.
Apple also has a new console to test push notifications. If you print out the token from deviceTokenReceived listener, you can use it to send a push notification from the console.
If you're using AWS SNS, you can use the following code to send a push notification
const message = // apns
os === 'ios' ? JSON.stringify({ APNS: JSON.stringify(payload) })
: // fcm
JSON.stringify({
GCM: JSON.stringify({
data: {
title: title,
body: body,
custom: customData,
data: customData,
priority: '1',
imageUrl:
'https://logo.png',
targetClass: 'com.yourapp.candle.MainActivity',
},
})
})
We are open to contributions. Please read our Contributing Guide for more information.
This project is licensed under the terms of the MIT license.
Post in #oss channel in our Discord if you have any questions or want to contribute.
FAQs
Gary Tokman
The npm package @candlefinance/push receives a total of 1 weekly downloads. As such, @candlefinance/push popularity was classified as not popular.
We found that @candlefinance/push demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.