Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@mattermost/client
Advanced tools
This package contains the JavaScript/TypeScript client for Mattermost. It's used by the Mattermost web app and related projects.
$ npm install @mattermost/client
$ npm install @mattermost/client @mattermost/types
To use this client, create an instance of Client4
, set the server URL, and log in, and then you can start making requests.
import {Client4} from '@mattermost/client';
const client = new Client4();
client.setUrl('https://mymattermostserver.example.com');
client.login('username', 'password').then((user) => {
// ...
});
If you already have a session token or a user access token, you can call Client4.setToken
instead of logging in.
import {Client4} from '@mattermost/client';
const client = new Client4();
client.setUrl('https://mymattermostserver.example.com');
client.setToken('accesstoken');
If needed, methods exist to set other headers such as the User-Agent (Client4.setUserAgent
), the CSRF token (Client4.setCSRF
), or any extra headers you wish to include (Client4.setHeader
).
Methods of Client4
which make requests to the server return a Promise
which does the following:
ClientResponse<T>
object which contains the the Response (response
), a Map of headers (headers
), and the data sent from the server (data
).ClientError
which contains the error message and the URL being requested. If the error happened on the server, the status code and an error ID (server_error_id
) are included.let user;
try {
user = (await client.getUser('userid')).data;
} catch (e) {
console.error(`An error occurred when making a request to ${e.url}: ${e.message}`);
}
To use the WebSocket client, create an instance of WebSocketClient
and then call its initialize
method with the connection URL and an optional session token or user access token. After that, you can call the client's addMessageListener
method to register a listener which will be called whenever a WebSocket message is received from the server.
import {WebSocketClient} from '@mattermost/client';
// If you already have an instance of Client4, you can call its getWebSocketUrl method to get this URL
const connectionUrl = 'https://mymattermostserver.example.com/api/v4/websocket';
// In a browser, the token may be passed automatically from a cookie
const authToken = process.env.TOKEN;
const wsClient = new WebSocketClient();
wsClient.initialize(connectionUrl, authToken);
wsClient.addMessageListener((msg) => {
if (msg.event === 'posted') {
console.log('New post received', JSON.parse(msg.data.post));
}
});
Note that WebSocketClient
expects globalThis.WebSocket
to be defined as it was originally written for use in the Mattermost web app. If you're using it in a Node.js environment, you should set globalThis.WebSocket
before instantiating the WebSocketClient
.
import WebSocket from 'ws';
if (!globalThis.WebSocket) {
globalThis.WebSocket = WebSocket;
}
const wsClient = new WebSocketClient();
This can also be done using dynamic imports if you're using them.
if (!globalThis.WebSocket) {
const {WebSocket} = await import('ws');
globalThis.WebSocket = WebSocket;
}
const wsClient = new WebSocketClient();
As a member of Mattermost with write access to our NPM organization, you can build and publish this package by running the following commands:
npm run build --workspace=platform/client
npm publish --workspace=platform/client
Make sure to increment the version number in package.json
first! You can add -0
, -1
, etc for pre-release versions.
FAQs
JavaScript/TypeScript client for Mattermost
We found that @mattermost/client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.