
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@mattermost/client
Advanced tools
This package contains the JavaScript/TypeScript client for Mattermost. It's used by the Mattermost web app and related projects.
$ npm install @mattermost/client
$ npm install @mattermost/client @mattermost/types
To use this client, create an instance of Client4, set the server URL, and log in, and then you can start making requests.
import {Client4} from '@mattermost/client';
const client = new Client4();
client.setUrl('https://mymattermostserver.example.com');
client.login('username', 'password').then((user) => {
// ...
});
If you already have a session token or a user access token, you can call Client4.setToken instead of logging in.
import {Client4} from '@mattermost/client';
const client = new Client4();
client.setUrl('https://mymattermostserver.example.com');
client.setToken('accesstoken');
If needed, methods exist to set other headers such as the User-Agent (Client4.setUserAgent), the CSRF token (Client4.setCSRF), or any extra headers you wish to include (Client4.setHeader).
Methods of Client4 which make requests to the server return a Promise which does the following:
ClientResponse<T> object which contains the the Response (response), a Map of headers (headers), and the data sent from the server (data).ClientError which contains the error message and the URL being requested. If the error happened on the server, the status code and an error ID (server_error_id) are included.let user;
try {
user = (await client.getUser('userid')).data;
} catch (e) {
console.error(`An error occurred when making a request to ${e.url}: ${e.message}`);
}
To use the WebSocket client, create an instance of WebSocketClient and then call its initialize method with the connection URL and an optional session token or user access token. After that, you can call the client's addMessageListener method to register a listener which will be called whenever a WebSocket message is received from the server.
import {WebSocketClient} from '@mattermost/client';
// If you already have an instance of Client4, you can call its getWebSocketUrl method to get this URL
const connectionUrl = 'https://mymattermostserver.example.com/api/v4/websocket';
// In a browser, the token may be passed automatically from a cookie
const authToken = process.env.TOKEN;
const wsClient = new WebSocketClient();
wsClient.initialize(connectionUrl, authToken);
wsClient.addMessageListener((msg) => {
if (msg.event === 'posted') {
console.log('New post received', JSON.parse(msg.data.post));
}
});
Note that WebSocketClient expects globalThis.WebSocket to be defined as it was originally written for use in the Mattermost web app. If you're using it in a Node.js environment, you should set globalThis.WebSocket before instantiating the WebSocketClient.
import WebSocket from 'ws';
if (!globalThis.WebSocket) {
globalThis.WebSocket = WebSocket;
}
const wsClient = new WebSocketClient();
This can also be done using dynamic imports if you're using them.
if (!globalThis.WebSocket) {
const {WebSocket} = await import('ws');
globalThis.WebSocket = WebSocket;
}
const wsClient = new WebSocketClient();
As a member of Mattermost with write access to our NPM organization, you can build and publish this package by running the following commands:
npm run build --workspace=platform/client
npm publish --workspace=platform/client
Make sure to increment the version number in package.json first! You can add -0, -1, etc for pre-release versions.
FAQs
JavaScript/TypeScript client for Mattermost
The npm package @mattermost/client receives a total of 3,077 weekly downloads. As such, @mattermost/client popularity was classified as popular.
We found that @mattermost/client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.