Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@parallelmarkets/vanilla
Advanced tools
This library provides a loading wrapper for the Parallel Markets JavaScript SDK as an ES module.
For a quick start, check out the example app.
Use npm
to install the Parallel JS SDK module:
$> npm install --save @parallelmarkets/vanilla
The loadParallel
function returns a promise that resolves once the SDK is loaded and ready. See below for an example using the async/await
syntax in vanilla JavaScript.
import { loadParallel } from '@parallelmarkets/vanilla'
// load the parallel library with the given configuration information
const parallel = await loadParallel({ client_id: '123', environment: 'demo' })
// any element with the "parallel-login-button" class will render a button
parallel.showButton()
// at this point, all of the SDK functions can be called - i.e.,
// parallel.login(), parallel.subscribe(), etc.
Once the library is loaded, you can immediately utilize the SDK.
After the Parallel SDK has been initialized (via loadParallel()
), you can show a Parallel button or explicitly initiate a flow.
To automatically load a Parallel Passport button on your page, just follow these steps:
parallel-login-button
to the parent element where you want the button to appear.showButton()
, which will then find any elements with that class and render a login button child element for each.For instance, to add a "Parallel Passport" button somewhere on your page:
<div class="parallel-login-button"></div>
import { loadParallel } from '@parallelmarkets/vanilla'
// wait for the loading to finish before calling any functions
const parallel = await loadParallel({ client_id: '123', environment: 'demo', flow_type: 'overlay' })
parallel.showButton()
Alternatively, you can provide your own button or link and call Parallel.login()
when you're ready to send the user into an authentication flow. For instance:
<a href="#" onClick="showParallelFlow()">Log in with Parallel </a>
import { loadParallel } from '@parallelmarkets/vanilla'
// wait for the loading to finish before calling any functions
const parallel = await loadParallel({ client_id: '123', environment: 'demo', flow_type: 'overlay' })
const showParallelFlow = () => {
parallel.login()
}
Upon completion, the user will be on the same page on your site where the authentication flow was initiated regardless of flow_type
. This must be the same URL as the redirect_uri
you provided when your account was first set up. This URL must match only for the initial authentication process. After that, you can call the getLoginStatus()
and getProfile()
functions on any page in your domain that has the Parallel Javascript SDK loaded.
The result of any successful authentication event will include an authResponse
field that indicates the status of the handoff. Once the status is connected
, you can call the getProfile()
function to get the Parallel ID for the user or business that completed the flow (along with other profile information). The ID can then be saved to your backend so your servers can make ongoing calls to get/update information for the user/business.
Here's an example of a few lines you can add to the example above if you want to send the profile information (including Parallel ID) to your backend.
parallel.subscribe('auth.login', () => {
parallel.getProfile((profile) => {
// example showing structure of the profile information
console.log("Here's the profile info:", profile)
// Call your backend to save the resulting ID to your backend so your server
// can make ongoing calls to get/update information for this user/business.
// In this example, your server would just save the resulting Parallel ID in
// the profile information POSTed alongside the other investor profile information
// you have stored on your backend. For example, assuming that getInvestorId() returns
// your unique ID for the user/business:
const body = JSON.stringify({ profile, internalId: getInvestorId() })
fetch('/save-parallel-id', { method: 'POST', body })
})
})
FAQs
ParallelMarkets.com JavaScript SDK loading utility
The npm package @parallelmarkets/vanilla receives a total of 583 weekly downloads. As such, @parallelmarkets/vanilla popularity was classified as not popular.
We found that @parallelmarkets/vanilla demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.