
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@metservice/metraweather-client-credentials
Advanced tools
A library to faciliate exchanging client credentials for a JWT
In order to use MetraWeather's APIs you must have a valid JWT which you can get by calling our API with your client credentials.
This JavaScript library wraps that API and caches the token until ten minutes before expiry. It retries on failure and uses an increasing back-off on each failure.
This repo is mostly to show you how you could make this request, the code is open source and you are free to port it to whatever language you prefer.
It is making the equivalent call of the following cURL:
curl --location --request POST 'https://metraweather.okta.com/oauth2/aus806w3t6ASnEeMm2p7/v1/token' \
--header 'accept: application/json' \
--header 'cache-control: no-cache' \
--header 'content-type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic ...' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=tier'
Postman can import cURL and convert it to various code samples.
The Authorization header scheme used by this API is "Basic".
The basic steps are:
client id
and client secret
together with a colon (clientId:clientSecret
)window.btoa('clientId:clientSecret');
) becomes Y2xpZW50SWQ6Y2xpZW50U2VjcmV0
Basic
, so if your clientId and clientSecret were clientId
and clientSecret
you'd end up with Basic Y2xpZW50SWQ6Y2xpZW50U2VjcmV0
Add this project to your npm/yarn project with yarn add @metservice/metraweather-client-credentials
or npm install @metservice/metraweather-client-credentials
.
You can then use this library with:
import { getJwtFromClientCredentials } from '@metservice/metraweather-client-credentials';
// Replace this with however you load in secure credentials, this may be from disk, environment variables, SSM/SecretsManager in AWS, etc.
const { clientId, clientSecret } = loadSecureCredentials();
const fetchDataFromApi = async () => {
// You can call this as many times as you want, the token is cached until ten minutes before expiry.
const token = await getJwtFromClientCredentials({
clientId,
clientSecret
});
//Call a MetraWeather API with your token
}
FAQs
A library to faciliate exchanging client credentials for a JWT
The npm package @metservice/metraweather-client-credentials receives a total of 75 weekly downloads. As such, @metservice/metraweather-client-credentials popularity was classified as not popular.
We found that @metservice/metraweather-client-credentials demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.