
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@wecity/weapps-plugin-citycode-callback
Advanced tools
功能: 1.回调的能力 2.回调后开启消息订阅的能力,当小程序设置中关闭了消息订阅,则会先去提醒用户开启,若开启了,则会调起消息订阅的授权弹框。
功能: 1.回调的能力 2.回调后开启消息订阅的能力,当小程序设置中关闭了消息订阅,则会先去提醒用户开启,若开启了,则会调起消息订阅的授权弹框。
import { cbClass } from "@govcloud/weapps-plugin-city-code-utils";
cb = new cbClass({
duration: 3000, // 轮询时间(ms),默认3s
timeout: 15000, // 超时时间(ms),不传则进行超时处理
});
cb.onScanWaiting(() => {
//...
})
.then((res) => {
// ...回调成功处理
})
.catch((res) => {
// ...回调失败处理
});
举例:
cb.onScanWaiting(() =>
app.http.default({
url: "/ebus/citycode/ext/callback/mock/polling",
method: "POST",
data: { cityCodeId },
})
)
.then((res) => {
console.log("扫码回调的最终结果-成功", res);
$page.handler.refreshQrCode();
})
.catch((res) => {
console.log("扫码回调的最终结果-失败", res);
});
cb.onScanWaiting 需传入一个方法,一般是 http 请求,并且该方法返回的是模版数据,必须是如下结构:
模版数据中: 当 templateType = 0 时,回调结束将直接 resolve, 当 templateType 为其他值时, 回调结束后将会先跳转到回调模版页面,点击按钮后会调起消息订阅的触发流程,其中 tmplIds 是模版 id,目前仅支持一次订阅 3 个。
{
"bizData": {
"templateType": , //... 模版类型
"document": {
"desc": "你的城市码已被门禁于2018年3月26日扫描", // 模版页面描述
"button": "确定" // 模版页面按键文字
},
"msgTmpl": {
"tmplIds": [
//... 模版id
],
"subscribe": true // 是否需要订阅消息
}
},
//...
}
举例如下:
{
"cityCodeAppId": "A00D",
"cityCodeId": "xxx",
"bizData": {
"templateType": 0
//...
}
}
{
"cityCodeAppId": "A00D",
"cityCodeId": "xxxx",
"bizData": {
"templateType": 4,
"document": {
"desc": "你的城市码已被门禁于2020年10月1日扫描",
"button": "确定"
},
"msgTmpl": {
"tmplIds": ["xxxxx"],
"subscribe": true
}
}
}
注意:当回调成功后,则会在.then 中输出结果,即使订阅消息失败 只有在回调失败或者入参错误等,才会 reject 出来
例如:成功时.then 中的结果有以下几种形式:
{
esScanRes: {
bizData : {
document: {
//...
},
msgTmpl: {
//...
}
}
},
subscribRes: {
res: {
ZdxKTIrKR_bedh1K3aed2ZunNOB_EHqSe0i0oCT8hWM: "accept",
d9CZgtdL5rifendw2SsekvhoZj1mEexKnFiGga0oC6s: "accept"
}
}
}
其中esScanRes是回调请求的结果。 subscribRes是订阅的结果,若订阅成功,则subscribRes会返回res,res里面是订阅的结果;若订阅失败,则会返回errMsg,显示错误来源。
cb.offScanWaiting();
cb.reset();
FAQs
功能: 1.回调的能力 2.回调后开启消息订阅的能力,当小程序设置中关闭了消息订阅,则会先去提醒用户开启,若开启了,则会调起消息订阅的授权弹框。
We found that @wecity/weapps-plugin-citycode-callback demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.