
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@peacechen/react-native-otp-autocomplete
Advanced tools
React native sms verification without additional permissions.
This is a fork of https://github.com/jmlavoier/react-native-otp-autocomplete and published as a separate package on [npmjs.com](https://www.npmjs.com/package/@peacechen/react-native-otp-autocomplete to unlock the peer dependencies. That package was forked from react-native-otp-verify which was deprecated.
It uses Automatic SMS Verification with the SMS Retriever API. With the SMS Retriever API, you can perform SMS-based user verification in your Android app automatically, without requiring the user to manually type verification codes, and without requiring any extra app permissions.
In order to detect the message, SMS message must include a hash that identifies your app. This hash can be obtained by using the getHash() method below.
Please read the official documentation for the message structure at this Google developer guide
$ npm install @peacechen/react-native-otp-autocomplete --save
or
$ yarn @peacechen/react-native-otp-autocomplete
$ react-native link @peacechen/react-native-otp-autocomplete
android/app/src/main/java/[...]/MainActivity.java
import com.jmlavoier.OtpAutocomplete.RNOtpAutocompletePackage;
to the imports at the top of the filenew RNOtpAutocompletePackage()
to the list returned by the getPackages()
methodandroid/settings.gradle
:
include ':@peacechen/react-native-otp-autocomplete'
project(':@peacechen/react-native-otp-autocomplete').projectDir = new File(rootProject.projectDir, '../node_modules/@peacechen/react-native-otp-autocomplete/android')
android/app/build.gradle
:
compile project(':@peacechen/react-native-otp-autocomplete')
import OtpAutocomplete from '@peacechen/react-native-otp-autocomplete';
const getHash = () =>
OtpAutocomplete.getHash()
.then(console.log)
.catch(console.log);
const startListeningForOtp = () =>
OtpAutocomplete.getOtp()
.then(p => OtpAutocomplete.addListener(otpHandler))
.catch(p => console.log(p));
const otpHandler = (message: string) => {
const otp = /(\d{4})/g.exec(message)[1];
this.setState({ otp });
OtpAutocomplete.removeListener();
Keyboard.dismiss();
}
useEffet(() => {
startListeningForOtp();
return () => OtpAutocomplete.removeListener();
}, [startListeningForOtp]);
getOtp():Promise<boolean>
Start listening for OTP/SMS. Return true if listener starts else throws error.
getHash():Promise<string[]>
Gets the hash code for the application which should be added at the end of message. This is just a one time process.
addListener(handler:(message:string)=>any):Promise<boolean>
Adds a javascript listener to the handler passed which is called when message is received.
removeListener():void
Removes the listener.
FAQs
React native sms verification without additional permissions.
The npm package @peacechen/react-native-otp-autocomplete receives a total of 233 weekly downloads. As such, @peacechen/react-native-otp-autocomplete popularity was classified as not popular.
We found that @peacechen/react-native-otp-autocomplete demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.