
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@livechat/agent-app-widget-sdk
Advanced tools
Note: if you're developing a new widget, you should use the Agent App SDK instead. This package isn't actively maintained anymore.
This SDK allows you to create widget applications that can interact with the AgentApp.
The package can be installed directly from NPM.
npm install --save @livechat/agent-app-widget-sdk
Before performing any actions you have to initialize the SDK by calling the asynchronous init method. Make sure the returned promise resolves.
import LiveChat from '@livechat/agent-app-widget-sdk';
await LiveChat.init();
Now you can send commands or subscribe to events coming from the AgentApp.
The SDK exposes methods that you can call in order to interact with the AgentApp. All methods return a promise which resolves after the command has been successfully sent.
putMessage(text)This method will add the given text to the currently opened chat textarea.
await Livechat.putMessage('This text will be added to current chat textarea');
watchMessages()Subscribe to all incoming and outgoing chat messages. You can listen to the messages using the message event.
Livechat.on('message', message => {
// handle the message here
});
await Livechat.watchMessages();
modifyCustomerDetailsSection(section)This method allows you to modify any custom section that you declared in the initial state of widget in the Developers Console. The section argument should be an object conforming to the section defintion schema, for example:
const section = {
title: 'My section',
components: [
// ...
{
type: 'button',
data: {
label: 'My section button',
id: 'section-button'
}
}
// ...
]
};
await Livechat.modifyCustomerDetailsSection(section);
The given section title must match the one specified in the initial state, otherwise the section won't change. Also, AgentApp ignores commands that do not contain a valid section definition, so make sure that
definition you're sending is correct.
The SDK allows you to listen for certain events happening in the AgentApp. You can subscribe to them using the standard event emitter interface.
LiveChat.on(event, eventHandler);
The SDK emits the following events:
customer_profileEmitted on initialization and on every chat window change, the event contains the currently selected customer's details.
Livechat.on('customer_profile', data => {
console.log(data);
});
Example output
{
"id": "S126126161.O136OJPO1",
"name": "Mary Brown",
"email": "mary.brown@email.com",
"chat": {
"id": "NY0U96PIT4"
}
}
messageEmitted on every chat message (both outgoing and incoming). You have to subscribe to the events using the watchMessages method first.
Livechat.on('message', data => {
console.log(data);
});
Example output
{
"chat": "PL0B4IDJIO",
"message": "Message content",
"message_id": "edu65huxyk",
"message_source": "visitor"
}
customer_details_section_button_clickEmitted when a button within custom defined section is clicked in Customer Details. It contains a buttonId property, which reflects the id specified for the button in the section definition.
Livechat.on('customer_details_section_button_click', ({ buttonId }) => {
console.log(buttonId);
});
FAQs
SDK for LiveChat inapp widget API
We found that @livechat/agent-app-widget-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 47 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.