Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@heroiclabs/satori-js
Advanced tools
JavaScript client for Satori server written in TypeScript. For browser and React Native projects.
This client implements the full API for interacting with Satori server. It's written in TypeScript with minimal dependencies to be compatible with all modern browsers and React Native.
Full documentation is online - https://heroiclabs.com/docs/javascript-client-guide
You'll need access to an instance of the Satori server before you can connect with the client.
npm install @heroiclabs/satori-js
You'll now see the code in the "node_modules" folder and package listed in your "package.json".
import {Client} from "@heroiclabs/satori-js";
const useSSL = false;
const client = new Client("apiKey", "127.0.0.1", 7450, useSSL);
The client object has many method to execute various features in the server.
To authenticate with the Satori server you must provide an identifier for the user.
const userId = "<UniqueUserId>";
client.authenticate(userId)
.then(session => {
_session = session;
console.info("Authenticated:", session);
}).catch(error => {
console.error("Error:", error);
});
When authenticated the server responds with an auth token (JWT) which contains useful properties and gets deserialized into a Session
object.
console.info(session.token); // raw JWT token
console.info(session.refreshToken); // refresh token
console.info("Session has expired?", session.isexpired(Date.now() / 1000));
const expiresAt = session.expires_at;
console.warn("Session will expire at:", new Date(expiresAt * 1000).toISOString());
It is recommended to store the auth token from the session and check at startup if it has expired. If the token has expired you must reauthenticate. The expiry time of the token can be changed as a setting in the server.
// Assume we've stored the auth token in browser Web Storage.
const authtoken = window.localStorage.getItem("satori_authtoken");
const refreshtoken = window.localStorage.getItem("satori_refreshtoken");
let session = satorijs.Session.restore(authtoken, refreshtoken);
// Check whether a session is close to expiry.
const unixTimeInFuture = Date.now() + 8.64e+7; // one day from now
if (session.isexpired(unixTimeInFuture / 1000)) {
try
{
session = await client.sessionRefresh(session);
}
catch (e)
{
console.info("Session can no longer be refreshed. Must reauthenticate!");
}
}
The client includes lots of builtin APIs for various featyures of the Satori server. These can be accessed with the methods which return Promise objects.
Most requests are sent with a session object which authorizes the client.
const flags = await client.getFlags(session);
console.info("Flags:", flags);
The development roadmap is managed as GitHub issues and pull requests are welcome. If you're interested in enhancing the code please open an issue to discuss the changes or drop in and discuss it in the community forum.
Ensure you are using Node v18>.
The codebase is multi-package monorepo written in TypeScript and can be built with esbuild. All dependencies are managed with Yarn.
To build from source, install dependencies and build the satori-js
package:
npm install --workspace=@heroiclabs/satori-js && npm run build --workspace=@heroiclabs/satori-js
To run tests you will need access to an instance of the Satori server.
Tests are run against each workspace bundle; if you have made source code changes, you should npm run build --workspace=<workspace>
prior to running tests.
npm run test --workspace=@heroiclabs/satori-js-test
To release onto NPM if you have access to the "@heroiclabs" organization you can use NPM.
npm run build --workspace=<workspace> && npm publish --access=public --workspace=<workspace>
API docs are generated with typedoc and deployed to GitHub pages.
To run typedoc:
npm install && npm run docs
This project is licensed under the Apache-2 License.
FAQs
JavaScript client for Satori server written in TypeScript.
The npm package @heroiclabs/satori-js receives a total of 0 weekly downloads. As such, @heroiclabs/satori-js popularity was classified as not popular.
We found that @heroiclabs/satori-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.