Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@kayako/apps-proxy
Advanced tools
This package is used by Kayako apps server and the local development server to make proxy requests from the installed apps.
This package is used by Kayako apps server and the local development server to make proxy requests from the installed apps.
The job of the package is to take a packet and make a HTTP request by reading information from the packet. It doesn't store any information of it's own.
npm i https://github.com/kayako/apps-proxy.git
const { proxy } = require('apps-proxy')
await proxy.makeRequest(payload, options)
Here is the list of accepted values in payload
key | value | description |
---|---|---|
url | String | Url where to make the HTTP request. |
method | String | HTTP request method |
headers | Object | An object of headers to pass to the actual server |
body | Object | Http request body, must be valid Javascript Object. |
params | Object | Params to pass as URL query string. |
Here is the list of required options.
key | value | description |
---|---|---|
whiteListedDomains | Array | An array of whitelisted domains. Only urls from this array will be allowed, else if an exception will be raised. |
tokens | Object | An object of values to replace the dynamic placeholders. |
Only following content types are allowed in the content-type
header. This service will transform the body itself based upon the content-type
.
The response structure is defined below.
{
data: {
status: 200,
statusText: 'OK',
headers: {},
body: {}
}
}
Below is the used terms and what they mean. These terms are not unique to the proxy service, but instead used in the apps space.
These are values, which are not known to the app developer, but developer does know the keys
for these values.
For example: App needs the apiKey
to make some HTTP request, so developer use a placeholder for that key and at runtime, that value is replaced by the server.
proxy.makeRequest({
url: '{{ params.domain }}.salesforce.com'
}, {
tokens: {
params: {
domain: 'kayako'
}
}
})
When making the request, params.domain
will be replace with the defined value.
NOTE: An exception will be raised if placeholders are defined, but their values are missing.
Each exception raised from this package, will have a key called translation
. You can use this key to define a human readable message for that exception.
try {
await proxy.makeRequest(payload, options)
} catch (error) {
const message = antl.formatMessage(error.translation.key, error.translation.values)
response.send(message)
}
FAQs
This package is used by Kayako apps server and the local development server to make proxy requests from the installed apps.
We found that @kayako/apps-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.