
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@cuyl/wechat-enterprise-api
Advanced tools
微信企业号API。
详细参见API文档
微信企业号官方文档(http://qydev.weixin.qq.com/wiki/index.php)
订阅号和服务号版本请前往:https://github.com/node-webot/co-wechat-api
$ npm install co-wechat-enterprise-api
const API = require('co-wechat-enterprise-api');
const api = new API(corpid, corpsecret);
const result = await api.updateRemark('open_id', 'remarked');
当多进程时,token需要全局维护,以下为保存token的接口。
const api = new API('corpid', 'corpsecret', async function() {
// 传入一个获取全局token的方法
const txt = await fs.readFile('access_token.txt', 'utf8');
return JSON.parse(txt);
}, async function(token) {
// 请将token存储到全局,跨进程、跨机器级别的全局,比如写到数据库、redis等
// 这样才能在cluster模式及多机情况下使用,以下为写入到文件的示例
await fs.writeFile('access_token.txt', JSON.stringify(token));
});
对于大规模的集群部署模式,为了安全和速度,会有一些负载均衡的节点放在内网的服务器上(即负载均衡的节点与主结点通过内网连接,并且内网服务器上没有外网的IP)。这时,就需要配置代理服务器来使内网的机器可以有限度的访问外网的资源。例如:微信套件中的各种主动调用接口。
如何架设代理服务器在这里不做赘述,一般推荐使用squid 3,免费、快速、配置简单。
由于需要访问的微信API服务器是https协议,所以普通的http代理模式不能使用。 而一般都是http协议的代理服务器。 我们要实现的就是通过http代理通道来走https的请求。
基本的步骤是2步:
一、下载node-tunnel 注意:npm上的版本较老,不支持node v0.10以上的版本。
二、使用 httpsOverHttp 这个agent。
三、将agent配置给httpx。
const tunnel = require('tunnel');
const agent = tunnel.httpsOverHttp({
proxy: {
host: 'proxy_host_ip', // 代理服务器的IP
port: 3128 // 代理服务器的端口
}
});
api.setOpts({
agent: agent
});
The MIT license.
FAQs
微信企业号Node库API,ES6版本
The npm package @cuyl/wechat-enterprise-api receives a total of 0 weekly downloads. As such, @cuyl/wechat-enterprise-api popularity was classified as not popular.
We found that @cuyl/wechat-enterprise-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.