Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@degen/twitter-autohook
Advanced tools
Automatically setup and serve webhooks for the Twitter Account Activity API
This is a fork of Autohook that uses Fastify instead of needle.
You can use Autohook as a module or as a command-line tool.
const { Autohook } = require('twitter-autohook');
(async ƛ => {
const webhook = new Autohook();
// Removes existing webhooks
await webhook.removeWebhooks();
// Listens to incoming activity
webhook.on('event', event => console.log('Something happened:', event));
// Starts a server and adds a new webhook
await webhook.start();
// Subscribes to a user's activity
await webhook.subscribe({oauth_token, oauth_token_secret});
})();
Starting Autohook from the command line is useful when you need to test your connection and subscriptions.
When started from the command line, Autohook simply provisions a webhook, subscribes your user (unless you specify --do-not-subscribe-me
), and echoes incoming events to stdout
.
# Starts a server, removes any existing webhook, adds a new webhook, and subscribes to the authenticating user's activity.
$ autohook -rs
# All the options
$ autohook --help
Autohook works only when you pass your OAuth credentials. You won't have to figure out OAuth by yourself – Autohook will work that out for you.
You can pass your OAuth credentials in a bunch of ways.
Create a file named ~/.env.twitter
(sits in your home dir) with the following variables:
TWITTER_CONSUMER_KEY= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ API key
TWITTER_CONSUMER_SECRET= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ API secret key
TWITTER_ACCESS_TOKEN= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ Access token
TWITTER_ACCESS_TOKEN_SECRET= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ Access token secret
TWITTER_WEBHOOK_ENV= # https://developer.twitter.com/en/account/environments ➡️ One of 'Dev environment label' or 'Prod environment label'
NGROK_AUTH_TOKEN= # https://ngrok.com/ - (optional) Create a free account to get your auth token for stable tunnels
Autohook will pick up these details automatically, so you won't have to specify anything in code or via CLI.
Useful when you're deploying to remote servers, and can be used in conjunction with your dotenv file.
# To your current environment
export TWITTER_CONSUMER_KEY= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ API key
export TWITTER_CONSUMER_SECRET= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ API secret key
export TWITTER_ACCESS_TOKEN= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ Access token
export TWITTER_ACCESS_TOKEN_SECRET= # https://developer.twitter.com/en/apps ➡️ Your app ID ➡️ Details ➡️ Access token secret
export TWITTER_WEBHOOK_ENV= # https://developer.twitter.com/en/account/environments ➡️ One of 'Dev environment label' or 'Prod environment label'
export NGROK_AUTH_TOKEN= # https://ngrok.com/ - (optional) Create a free account to get your auth token for stable tunnels
# To other services, e.g. Heroku
heroku config:set TWITTER_CONSUMER_KEY=value TWITTER_CONSUMER_SECRET=value TWITTER_ACCESS_TOKEN=value TWITTER_ACCESS_TOKEN_SECRET=value TWITTER_WEBHOOK_ENV=value NGROK_AUTH_TOKEN=value
Not recommended, because you should always secure your credentials.
new Autohook({
token: 'value',
token_secret: 'value',
consumer_key: 'value',
consumer_secret: 'value',
ngrok_secret: 'value', // optional
env: 'env',
port: 1337
});
$ autohook \
--token $TWITTER_ACCESS_TOKEN \
--secret $TWITTER_ACCESS_TOKEN_SECRET \
--consumer-key $TWITTER_CONSUMER_KEY \
--consumer-secret $TWITTER_CONSUMER_SECRET \
--env $TWITTER_WEBHOOK_ENV \
--ngrok-secret $NGROK_AUTH_TOKEN # optional
# npm
$ npm i -g twitter-autohook
# Yarn
$ yarn global add twitter-autohook
FAQs
Automatically setup and serve webhooks for the Twitter Account Activity API
We found that @degen/twitter-autohook demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.