Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
An unofficial nodejs API wrapper for Hyundai BlueLink
npm install bluelinky
const BlueLinky = require('bluelinky');
const client = new BlueLinky({
username: 'someguy@example.com',
password: 'hunter1',
brand: 'hyundai',
region: 'US',
pin: '1234'
});
client.on('ready', async () => {
const vehicle = client.getVehicle('5NMS55555555555555');
try {
const response = await vehicle.lock();
console.log(response);
} catch (err) {
// log the error from the command invocation
}
});
client.on('error', async (err) => {
// something went wrong with login
});
Ensure you have a config.json
that matches the structure of the following, with your account details
{
"username": "email",
"password": "password",
"pin": "pin",
"brand": "kia" or "hyundai",
"vin": "vin",
"useInfo": false
}
Run an install for all the dependencies, npm install
Now you can invoke the debug.ts script with npm run debug
Checkout out the docs for more info.
Important information for login problems:
EU has specific Bluelinky options :
language
: The language to use when login into the system, it will also change the laguage of your mobile app. en
by default.stampMode
: Advanced The kind of stamping mechanism to use (LOCAL
| DISTANT
). DISTANT
by default. :warning: though LOCAL
seems to work properly, it's in beta for now.stampFile
: Advanced The DISTANT
stamp source to use. https://raw.githubusercontent.com/neoPix/bluelinky-stamps/master/${brand}-${appId}.v2.json
by default.In the EU region, stamps are used to sign every API queries. These stamps have a 1 week validity. Those stamps are using a tricky algorithm and cannot be replicated by Bluelinky and have to be generated by an external solution. An http call is performed to get the existing tokens. It is possible to specify an other path using the stampFile
option. This path can be a local file prefixed by file://
or from any webserver.
By default the case is 24H, but it can but customized at will. A nice trick is to run you own stamp generator http server and querying it regularly (with low cache timeout) for fresh stamps.
The JSON file must respect this format
| Regions
Give a ⭐️ if this project helped you!
Using Bluelinky may result in draining your 12V battery when refreshing from the car too often. Make sure you have read and understood the terms of use of your Kia or Hyundai account before using Bluelinky.
FAQs
An unofficial nodejs API wrapper for Hyundai bluelink
We found that bluelinky demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.