Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@eomm/fastify-telegram
Advanced tools
Create and manage a Telegram bot, easily.
This plugin is a good wrapper around Telegraf build by a Fastify maintainer.
Why you should use this plugin compared to what you can find on google?
This plugin instead:
npm install fastify-telegram
Plugin version | Fastify version | Telegraf version |
---|---|---|
^1.0.0 | ^4.0.0 | ^4.0.0 |
When you register the plugin, it will add a decorator to the Fastify instance.
You can use it to access the Telegraf instance and configure your bot:
const fastify = require('fastify')
const fastifyTelegram = require('fastify-telegram')
async function run () {
const app = fastify({
pluginTimeout: 10_000 // suggestion: increase the timeout
})
await app.register(fastifyTelegram, {
botToken: '123-abc', // [required] it must be a valid bot token
// [required] in webhook mode: the base url of your webhook
// [optional] in long polling mode: undefined
baseUrl: 'https://example.come',
// [optional]: customize the decorator name
decoratorBotName: 'telegramBot',
// [optional] this string is used to validate the incoming request
// Ref: https://core.telegram.org/bots/api#setwebhook
webhookSecret: 'secret',
// [optional]: the polling mode requires an health check that slows down the startup
// you can customize the max milliseconds to wait for the health check to pass
waitForHealthPolling: 3_000, // default: app.initialConfig.pluginTimeout / 6
// [optional] this function is called when an error is not handled
// by default it logs the error using `fastify.log.error`
// Ref: https://telegrafjs.org/index.html#/?id=error-handling
onUnhandledError: (err, ctx) => {
console.log(`Ooops, encountered an error for ${ctx.updateType}`, err)
}
})
// `app.telegramBot` is a Telegraf instance
// Now you can start using it:
app.telegramBot.on('text', (ctx) => ctx.reply('Hello World'))
await app.listen({ port: 3001 })
}
run()
In this mode, the Telegram bot will send the updates to your server, so the plugin must know the public base url of your server.
Then, it will register a POST route at the url /telegraf/<secretPath>
where <secretPath>
is a random string generated by Telegraf.
You can read the Webhook secret path from the app.telegramWebhook
decorator.
In this mode, the plugin will start a long polling process that will fetch the updates from the Telegram server by calling the method getUpdates
.
The timeout
is set to 50
seconds by default, and you can't change it: it's a Telegraf limitation.
You can pass the following options to the plugin:
botToken
: [required] it must be a valid bot tokenbaseUrl
: [required] in webhook mode: the base url of your webhook; in long polling mode: undefineddecoratorBotName
: [optional] customize the decorator namewebhookSecret
: [optional] this string is used to validate the incoming requestonUnhandledError
: [optional] this function is called when an error is not handled by default it logs the error using fastify.log.error
The plugin adds the following decorators to the Fastify instance:
app.telegramBot
: the Telegraf instanceapp.telegramWebhook
: the webhook secret path (only in webhook mode)Copyright Manuel Spigolon, Licensed under MIT.
FAQs
Create and manage a Telegram bot, easily
The npm package @eomm/fastify-telegram receives a total of 72 weekly downloads. As such, @eomm/fastify-telegram popularity was classified as not popular.
We found that @eomm/fastify-telegram demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.