
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@pinelab/vendure-plugin-accept-blue
Advanced tools
Vendure plugin for creating subscriptions with the Accept Blue platform
Create recurring subscriptions with the Accept Blue platform.
addPaymentToOrder
and supplies credit card details:
PaymentSettled
AcceptBluePlugin.init({
vendureHost: 'https://my-vendure-backend.io'
}),
:warning: Set Use test mode
in your payment handler in the admin UI to use Accept Blue in test mode.
These are the different payment methods you can use to pay for an order. Keep in mind that these examples use sample input data.
You can use the query eligibleAcceptBluePaymentMethods
to check what payment methods and card types are enabled. This is configured in Vendure: your Accept Blue API Key should have all methods enabled for this to work.
If a customer already has a payment method saved in Accept Blue, you can use that to pay for an order.
mutation {
addPaymentToOrder(
input: { method: "accept-blue", metadata: { paymentMethodId: 15087 } }
) {
... on Order {
id
code
}
}
}
mutation {
addPaymentToOrder(
input: {
method: "accept-blue"
metadata: {
name: "Hayden Zieme"
routing_number: "011000138"
account_number: "49000002087"
account_type: "Checking"
sec_code: "PPD"
}
}
) {
... on Order {
id
code
}
}
}
With the hosted tokenization form, you can obtain a token that represents a credit card, and use that to pay for an order. More info on hosted tokenization here: https://docs.accept.blue/tokenization/v0.2
mutation {
addPaymentToOrder(
input: {
method: "accept-blue"
metadata: {
source: "nonce-z5frsiogt4kce2paljeb"
last4: "1115"
expiry_year: 2030
expiry_month: 3
}
}
) {
... on Order {
id
code
}
}
}
After an order is placed, the order.lines.acceptBlueSubscriptions
is populated with the actual subscription values from the Accept Blue platform, so it will not call your strategy anymore. This is to better reflect the subscription that was actually created at the time of ordering.
This means you can now also get the transactions per subscriptions with the field order.lines.acceptBlueSubscriptions.transactions
. To refund a transaction, you first need to get the transaction id.
# Sample query
{
orderByCode(code: "NQWHJ7FNYV7M348Z") {
id
code
lines {
acceptBlueSubscriptions {
name
variantId
amountDueNow
priceIncludesTax
recurring {
amount
interval
intervalCount
startDate
endDate
}
transactions {
id
createdAt
settledAt
amount
status
errorCode
errorMessage
checkDetails {
# This object is populated when the transaction was made with Check
name
routingNumber
last4
}
cardDetails {
# This object is populated when the transaction was made with a Credit Card
name
last4
expiryMonth
expiryYear
}
}
}
}
}
}
Only the initial payment is handled as a Vendure payment, any other refunds are done via a dedicated mutation:
mutation {
refundAcceptBlueTransaction(transactionId: 123, amount: 4567, cvv2: "999") {
referenceNumber
version
status
errorMessage
errorCode
errorDetails
}
}
The arguments amount
and cvv2
are optional, see the Accept Blue Docs for more info.
You can update created subscriptions in Accept Blue as Admin via de admin-api with UpdateOrder
permissions:
mutation {
updateAcceptBlueSubscription(
input: {
id: 11820
title: "New Title For Updated Subscription"
frequency: daily
}
) {
id
name
variantId
recurring {
interval
intervalCount
}
# ... additional subscription fields
}
}
This wil emit an AcceptBlueSubscriptionEvent
of type updated
.
You can use the query acceptBlueSurcharge
to see what surcharges your account has configured.
If you run into CORS issues loading the Accept Blue hosted tokenization javascript library, you might need to remove the cross-origin
key on your script
tag.
This plugin emits an AcceptBlueTransactionEvent
whenever it receives a webhook with a transaction update from Accept Blue.
import { AcceptBlueTransactionEvent } from '@pinelab/vendure-plugin-accept-blue';
// In your project's application bootstrap
this.eventBus.ofType(AcceptBlueTransactionEvent).subscribe((event) => {
// Do your magic here
// Please see the JS docs of `AcceptBlueTransactionEvent` for more information on this object.
// Event.orderLine may be undefined, for example when refund transactions come in. Refunds are currently not connected to an orderLine
});
This plugin also allows you to integration Google Pay. You will need to implement the Google Pay button on your storefront first.
After that, you end up with a token
you receive from Google. Send that data to Vendure like so:
mutation {
addPaymentToOrder(
input: {
method: "accept-blue"
metadata: {
source: "googlepay"
amount: 10.8
token: "{\"signature\":\"MEUCIFZG..."
}
}
) {
... on Order {
id
code
state
}
}
}
Make sure that your amount equals the amount of the order! The amount is passed in as whole amount, not in cents, because this is how you will receive it from Google.
You can configure the Merchant ID and Gateway Merchant ID on the payment method in Vendure, and fetch them via eligiblePaymentMethods
or eligibleAcceptBluePaymentMethods
.
FAQs
Vendure plugin for creating subscriptions with the Accept Blue platform
The npm package @pinelab/vendure-plugin-accept-blue receives a total of 103 weekly downloads. As such, @pinelab/vendure-plugin-accept-blue popularity was classified as not popular.
We found that @pinelab/vendure-plugin-accept-blue demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.