
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@netcentric/cm-notify-core
Advanced tools
Adobe Cloud Manager Pipeline Notifications to Slack, Teams and Email
Cloud Manager Notify Core is a Node.js application that process Cloud Manager events and sends notifications to Slack, Microsoft Teams or Email.
npm install --omit=dev --omit=peer @netcentric/cm-notify-core
const { CMNotify } = require('@netcentric/cm-notify-core');
const cmNotify = new CMNotify();
router.post('/cm-webhook', async (req, res, next) => {
const isValidEvent = await cmNotify.post(req);
if (!isValidEvent) {
return res.status(400).send('Invalid event');
}
// Message is sent to Slack/Teams
res.send('Valid event');
})
waitResponse
param in post
method.verify
param in post
method. For verification you need to set the secret
in the config. The secret can be a string, path to PublicKey or content of Public Key. /**
* Sends notifications to the configured channels.
* @param {Object} req - The request object containing the event data.
* @param {Object} config - Configuration options for the method.
* @param {boolean} [config.verify=false] - If true, verifies the request signature before processing.
* @param {boolean} [config.waitResponse=false] - If true, waits for all notifications to be settled before returning.
* @returns {Promise<Array<PromiseSettledResult<Awaited<*>>>|boolean>} - Returns a promise that resolves to the notification results or a boolean.
*/
async post(req, {
verify = false,
waitResponse = false
}) {}
const { CMNotify } = require('@netcentric/cm-notify-core');
const cmNotify = new CMNotify();
router.post('/cm-webhook', async (req, res, next) => {
try {
const allMessages = await cmNotify.post(req, { waitResponse: true });
allMessages.forEach((result, index) => {
if (result.status === 'fulfilled') {
console.log(`Posting Message ${index + 1} responded with value:`, result.value);
} else if (result.status === 'rejected') {
console.log(`Posting Message ${index + 1} rejected with reason:`, result.reason);
}
});
// Message is sent to Slack/Teams/Email
res.send('Valid event');
} catch (error) {
console.error(error);
res.status(400).send('Error sending messages');
}
});
/**
* @typedef {Object} CmNotifyConfig
* @property {string} [slackWebhook] - The Slack webhook URL (default: from environment variable SLACK_WEBHOOK).
* @property {string} [teamsEmail] - The Teams channel email address (default: from environment variable TEAMS_EMAIL).
* @property {string} [teamsWebhook] - The Teams webhook URL (default: from environment variable TEAMS_WEBHOOK).
* @property {string} [orgName] - The name of the organization (default: from environment variable ORGANIZATION_NAME).
* @property {string} [clientId] - The client ID (default: from environment variable CLIENT_ID).
* @property {string} [title] - The title of the notification (default: 'Cloud Manager Pipeline Notification').
* @property {string} [fromEmail] - The sender's email address (default: from environment variable EMAIL_FROM).
* @property {string} [dataPath] - The path to the directory containing data JSON files (default: from environment variable DATA_PATH or '.data').
* @property {string} [secret] - The secret used for verification, can be client_secret string, path to PublicKey or content of Public Key (default: from environment variable SECRET).
*/
class CMNotify {
/**
* @constructor
* @param {CmNotifyConfig} config - Configuration object for CMNotify.
*/
constructor(config = {}) {}
}
Cloud Manager Pipeline Notification:
STATUS: ended
DATE: 10.04.2025, 22:06:36 CET
NAME: piepeline-name
TARGET: STAGE_PROD
TYPE: WEB_TIER
URL: program/12345/pipeline/12345/execution/12345
@netcentric/cm-notify
CLI.pipelines-data.json
located in .data
directory.[
{
"name": "pipeline-name",
"id": "1234567",
"buildTarget": "DEV",
"type": "FRONT_END"
},
{
"name": "pipeline-name-dev",
"id": "1233217",
"buildTarget": "DEV",
"type": "CI_CD"
}
]
@netcentric/cm-notify
CLI to generate the token..data
directory in the gmail-token.json
file.google-credentials.json
in the .data
directory..env
file for sensitive data..env
file in the root folder with the following variables:Minimal required envs:
# Cloud Manager envs
ORGANIZATION_NAME=orgname# used to build the URL for the Pipeline
# Messanger apps env
SLACK_WEBHOOK=slack_webhook_url
All envs:
# Cloud Manager envs
ORGANIZATION_NAME=orgname# used to build the URL for the Pipeline
CLIENT_ID=e231#used to validate CM event
# Messanger apps env
SLACK_WEBHOOK=https://hooks.slack.com/services/123
# Teams webhook URL
TEAMS_WEBHOOK=https://prod-123.westus.logic.azure.com:443/workflows/123
# Teams email, alternative approach, if Webhook is disabled
TEAMS_EMAIL=email.onmicrosoft.com@amer.teams.ms
# Email sender env
# Only needed if Teams email approach is used
EMAIL_FROM=gmailuser@googleworkspacedomain.com
# App env (optional)
DATA_PATH=.data# path to the data folder wher tokens are stored, default is .data
Cloud Manager Events
FAQs
Adobe Cloud Manager Pipeline Notifications to Slack, Teams and Email
We found that @netcentric/cm-notify-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.