
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This package is based heavily off of the react-native-azure-ad-2 package found here: https://www.npmjs.com/package/@shedaltd/react-native-azure-ad-2. It has been adapted to specifically suit the KnightDash application and authentication at Calvin University.
Trying to access Microsoft Accounts is kind of bizarre. Microsoft previously separated their user accounts into two different domains, one for their cloud platform – Microsoft Azure – and another for general users who are using their services like Hotmail, One Drive or Xbox.
This meant developers had to use different authentication endpoints in order to authenticate users from different services.
:scream: :scream: :scream: :scream:
Thankfully they recently converged their disparate authentication service into a single service called “v2.0 endpoint” which allows you to use OAuth authentication for whichever Microsoft service account you have.
Authenticating a user via the v2 endpoint will give us access to a custom bearer token, this token allows us to consume REST APIs from the Microsoft Graph (a single end point into all Microsoft services) and allows your app to request for simple user data, for example first name, last name, email, and get other information like email messages, contacts and notes associated with their accounts.
This module is developed to help developers to integrated Microsoft V2 endpoint into their React-native app in a painless way.
Install package from npm
$ yarn add auth4061
First, import the component
import { AzureInstance, AzureLoginView } from "auth4061";
Then create an AzureInstance by using Microsoft application credential that we have registered. Also, adding application scope in order to ask users to consent when they login. For more information about scope see Microsoft blog.
const CREDENTIAILS = {
client_id: 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
client_secret: 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
redirect_uri: 'xxxx',
scope: 'User.Read email offline_access profile openid',
prompt: 'consent',
};
const Instance = new AzureInstance(CREDENTIAILS);
After that, create an AzureLoginView where you want the login WebView to be rendered and pass along with azureInstance that we have create from the last step.
render( ) {
return (
<AzureLoginView
azureInstance={this.azureInstance}
loadingMessage="Requesting access token"
onSuccess={this._onLoginSuccess}
onCancel={this._onLoginCancel}
/>
);
}
When combine all parts together, it will look similar to this.
import React from 'react';
import {AppRegistry, View} from 'react-native';
import {AzureInstance, AzureLoginView} from './azure';
// CONSTANT
const CREDENTIAILS = {
client_id: 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
client_secret: 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
redirect_uri: 'xxxx',
scope: 'User.ReadBasic.All Mail.Read offline_access'
};
export default class azureAuth extends React.Component {
constructor(props){
super(props);
this.azureInstance = new AzureInstance(CREDENTIAILS);
this._onLoginSuccess = this._onLoginSuccess.bind(this);
this._onLoginCancel = this._onLoginCancel.bind(this);
}
_onLoginSuccess(){
this.azureInstance.getUserInfo().then(result => {
console.log(result);
}).catch(err => {
console.log(err);
})
}
_onLoginCancel(){
// Show cancel message
}
render() {
return (
<AzureLoginView
azureInstance={this.azureInstance}
loadingMessage="Requesting access token"
onSuccess={this._onLoginSuccess}
onCancel={this._onLoginCancel}
/>
);
}
}
AppRegistry.registerComponent('azureAuth', () => azureAuth);
To see see an example app using the library have a look at the KnightDash Project.
FAQs
This will be a customized module for KnightDash.
The npm package auth4061 receives a total of 6 weekly downloads. As such, auth4061 popularity was classified as not popular.
We found that auth4061 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.