
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@xmtp/botkit
Advanced tools
Minimal viable package for creating bots.
For a streamlined setup process, you can use the create-xmtp-bot
CLI tool, which simplifies the creation and configuration of new XMTP bots.
npx create-xmtp-bot@latest bot-name
Please refer to its documentation.
Here's a basic example of the code with a bot that responds with a gm:
import { run, HandlerContext } from "@xmtp/botkit";
run(async (context: HandlerContext) => {
// Get the message and the address from the sender
const { content, senderAddress } = context.message;
// To reply, just call `reply` on the HandlerContext.
await context.reply(`gm`);
});
See more examples in the Awesome XMTP ⭐️ repo
Here’s how to easily deploy this bot:
Head to the tutorial on how to deploy an XMTP bot on Railway
To develop on this repo clone the repository containing the bot code:
git clone https://github.com/xmtp/botkit
cd botkit
# copy env variables template
cp .env.example .env
Set the variables
KEY= # 0x... the private key of the bot (with the 0x prefix)
XMTP_ENV=production # or `dev`
⚠️ Bot kit is not compatible with
bun
yet. Usenpm
oryarn
# install dependencies
yarn install
# running the bot
yarn build
yarn start
# to run with hot-reload
yarn build:watch
yarn start:watch
# run the gm example
yarn build:watch
yarn start:gm
Test the bots in messaging apps
Learn about the nearly 2 million identities part of XMTP by visiting this Dune dashboard.
FAQs
Minimal viable package for creating bots.
We found that @xmtp/botkit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.