
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@misskey-dev/summaly
Advanced tools
npm install @misskey-dev/summaly
As a function:
import { summaly } from 'summaly';
summaly(url[, opts])
As Fastify plugin:
(will listen GET
of /
)
import Summaly from 'summaly';
fastify.register(Summaly[, opts])
Run the server:
git clone https://github.com/misskey-dev/summaly.git
cd summaly
NODE_ENV=development npm install
npm run build
npm run serve
Property | Type | Description | Default |
---|---|---|---|
lang | string | Accept-Language for the request | null |
followRedirects | boolean | Whether follow redirects | true |
plugins | plugin[] (see below) | Custom plugins | null |
agent | Got.Agents | Custom HTTP agent (see below) | null |
userAgent | string | User-Agent for the request | SummalyBot/[version] |
responseTimeout | number | Set timeouts for each phase, such as host name resolution and socket communication. | 20000 |
operationTimeout | number | Set the timeout from the start to the end of the request. | 60000 |
contentLengthLimit | number | If set to true, an error will occur if the content-length value returned from the other server is larger than this parameter (or if the received body size exceeds this parameter). | 10485760 |
contentLengthRequired | boolean | If set to true, it will be an error if the other server does not return content-length. | false |
interface SummalyPlugin {
test: (url: URL) => boolean;
summarize: (url: URL) => Promise<Summary>;
}
urls are WHATWG URL since v4.
You can specify agents to be passed to Got for proxy use, etc.
https://github.com/sindresorhus/got/blob/v12.6.0/documentation/tips.md#proxying
⚠️If you set some agent, local IP rejecting will not work.⚠️
(Summaly usually rejects local IPs.)
(Summaly currently does not support http2.)
A Promise of an Object that contains properties below:
※ Almost all values are nullable. player should not be null.
Property | Type | Description |
---|---|---|
title | string | null | The title of the web page |
icon | string | null | The url of the icon of the web page |
description | string | null | The description of the web page |
thumbnail | string | null | The url of the thumbnail of the web page |
sitename | string | null | The name of the web site |
player | Player | The player of the web page |
sensitive | boolean | Whether the url is sensitive |
activityPub | string | null | The url of the ActivityPub representation of that web page |
fediverseCreator | string | null | The pages fediverse handle |
url | string | The url of the web page |
Omit<SummalyResult, "url">
Property | Type | Description |
---|---|---|
url | string | null | The url of the player |
width | number | null | The width of the player |
height | number | null | The height of the player |
allow | string[] | The names of the allowed permissions for iframe |
Currently the possible items in allow
are:
autoplay
clipboard-write
fullscreen
encrypted-media
picture-in-picture
web-share
See Permissions Policy in MDN for details of them.
import { summaly } from 'summaly';
const summary = await summaly('https://www.youtube.com/watch?v=NMIEAhH_fTU');
console.log(summary);
will be ... ↓
{
"title": "【アイドルマスター】「Stage Bye Stage」(歌:島村卯月、渋谷凛、本田未央)",
"icon": "https://www.youtube.com/s/desktop/711fd789/img/logos/favicon.ico",
"description": "Website▶https://columbia.jp/idolmaster/Playlist▶https://www.youtube.com/playlist?list=PL83A2998CF3BBC86D2018年7月18日発売予定THE IDOLM@STER CINDERELLA GIRLS CG STAR...",
"thumbnail": "https://i.ytimg.com/vi/NMIEAhH_fTU/maxresdefault.jpg",
"player": {
"url": "https://www.youtube.com/embed/NMIEAhH_fTU?feature=oembed",
"width": 200,
"height": 113,
"allow": [
"autoplay",
"clipboard-write",
"encrypted-media",
"picture-in-picture",
"web-share",
"fullscreen",
]
},
"sitename": "YouTube",
"sensitive": false,
"activityPub": null,
"url": "https://www.youtube.com/watch?v=NMIEAhH_fTU"
}
npm run test
FAQs
Get web page's summary
We found that @misskey-dev/summaly demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.