
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@netcentric/cm-notify-core
Advanced tools
Adobe Cloud Manager Pipeline Notifications to Slack, Teams and Email
Cloud Manager Notify Core is a Node.js application that process Cloud Manager events and sends notifications to Slack, Microsoft Teams or Email.
npm install --omit=dev --omit=peer @netcentric/cm-notify-core
const { CMNotify } = require('@netcentric/cm-notify-core');
const cmNotify = new CMNotify();
router.post('/cm-webhook', async (req, res, next) => {
const isValidEvent = await cmNotify.post(req);
if (!isValidEvent) {
return res.status(400).send('Invalid event');
}
// Message is sent to Slack/Teams
res.send('Valid event');
})
waitResponse param in post method.verify param in post method. For verification you need to set the secret in the config. The secret can be a string, path to PublicKey or content of Public Key. /**
* Sends notifications to the configured channels.
* @param {Object} req - The request object containing the event data.
* @param {Object} config - Configuration options for the method.
* @param {boolean} [config.verify=false] - If true, verifies the request signature before processing.
* @param {boolean} [config.waitResponse=false] - If true, waits for all notifications to be settled before returning.
* @returns {Promise<Array<PromiseSettledResult<Awaited<*>>>|boolean>} - Returns a promise that resolves to the notification results or a boolean.
*/
async post(req, {
verify = false,
waitResponse = false
}) {}
const { CMNotify } = require('@netcentric/cm-notify-core');
const cmNotify = new CMNotify();
router.post('/cm-webhook', async (req, res, next) => {
try {
const allMessages = await cmNotify.post(req, { waitResponse: true });
allMessages.forEach((result, index) => {
if (result.status === 'fulfilled') {
console.log(`Posting Message ${index + 1} responded with value:`, result.value);
} else if (result.status === 'rejected') {
console.log(`Posting Message ${index + 1} rejected with reason:`, result.reason);
}
});
// Message is sent to Slack/Teams/Email
res.send('Valid event');
} catch (error) {
console.error(error);
res.status(400).send('Error sending messages');
}
});
/**
* @typedef {Object} CmNotifyConfig
* @property {string} [slackWebhook] - The Slack webhook URL (default: from environment variable SLACK_WEBHOOK).
* @property {string} [teamsEmail] - The Teams channel email address (default: from environment variable TEAMS_EMAIL).
* @property {string} [teamsWebhook] - The Teams webhook URL (default: from environment variable TEAMS_WEBHOOK).
* @property {string} [orgName] - The name of the organization (default: from environment variable ORGANIZATION_NAME).
* @property {string} [clientId] - The client ID (default: from environment variable CLIENT_ID).
* @property {string} [title] - The title of the notification (default: 'Cloud Manager Pipeline Notification').
* @property {string} [fromEmail] - The sender's email address (default: from environment variable EMAIL_FROM).
* @property {string} [dataPath] - The path to the directory containing data JSON files (default: from environment variable DATA_PATH or '.data').
* @property {string} [secret] - The secret used for verification, can be client_secret string, path to PublicKey or content of Public Key (default: from environment variable SECRET).
*/
class CMNotify {
/**
* @constructor
* @param {CmNotifyConfig} config - Configuration object for CMNotify.
*/
constructor(config = {}) {}
}
Cloud Manager Pipeline Notification:
STATUS: ended
DATE: 10.04.2025, 22:06:36 CET
NAME: piepeline-name
TARGET: STAGE_PROD
TYPE: WEB_TIER
URL: program/12345/pipeline/12345/execution/12345
@netcentric/cm-notify CLI.pipelines-data.json located in .data directory.[
{
"name": "pipeline-name",
"id": "1234567",
"buildTarget": "DEV",
"type": "FRONT_END"
},
{
"name": "pipeline-name-dev",
"id": "1233217",
"buildTarget": "DEV",
"type": "CI_CD"
}
]
@netcentric/cm-notify CLI to generate the token..data directory in the gmail-token.json file.google-credentials.json in the .data directory..env file for sensitive data..env file in the root folder with the following variables:Minimal required envs:
# Cloud Manager envs
ORGANIZATION_NAME=orgname# used to build the URL for the Pipeline
# Messanger apps env
SLACK_WEBHOOK=slack_webhook_url
All envs:
# Cloud Manager envs
ORGANIZATION_NAME=orgname# used to build the URL for the Pipeline
CLIENT_ID=e231#used to validate CM event
# Messanger apps env
SLACK_WEBHOOK=https://hooks.slack.com/services/123
# Teams webhook URL
TEAMS_WEBHOOK=https://prod-123.westus.logic.azure.com:443/workflows/123
# Teams email, alternative approach, if Webhook is disabled
TEAMS_EMAIL=email.onmicrosoft.com@amer.teams.ms
# Email sender env
# Only needed if Teams email approach is used
EMAIL_FROM=gmailuser@googleworkspacedomain.com
# App env (optional)
DATA_PATH=.data# path to the data folder wher tokens are stored, default is .data
Cloud Manager EventsFAQs
Adobe Cloud Manager Pipeline Notifications to Slack, Teams and Email
We found that @netcentric/cm-notify-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.