
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
BonkBot is a JavaScript library for creating bots for the web game Bonk.io. It provides an easy way to create custom bots that can automate various actions within the game. With BonkBot, you can interact with the game's websocket protocol easily, chat with other players, and perform actions such as joining and leaving rooms.
To install BonkBot, you will need Node.js installed on your system. Then, run the following command in your terminal:
npm install bonkbot
const { createBot, LOG_LEVELS } = require('bonkbot');
// Create a bot instance
const bot = createBot({
account: {
username: 'BotName',
guest: true, // Use guest account
},
logLevel: LOG_LEVELS.WARN, // Set log level (DEBUG, INFO, WARN, ERROR, NONE)
});
// Initialize and handle events
bot.events.on('ready', async () => {
await bot.connect();
});
// Handle chat messages
bot.events.on('CHAT_MESSAGE', (message) => {
console.log(`${message.player.username}: ${message.message}`);
// Respond to !ping command
if (message.message === '!ping') {
bot.chat('Pong!');
}
});
bot.events.on('PACKET', (packet) => {
bot.autoHandlePacket(packet);
});
bot.init();
By default, BonkBot will automatically determine the optimal server to connect to by querying the game's API. This ensures your bot connects to the most appropriate server based on the current game infrastructure.
If you want to override this behavior and connect to a specific server, you can provide the server option when creating the bot:
const bot = createBot({
// ... other options
server: 'b2ny1', // Force connection to a specific server
});
const bot = createBot({
account: {
username: 'BotName',
guest: true,
},
logLevel: LOG_LEVELS.WARN,
});
const bot = createBot({
account: {
username: 'YourUsername',
password: 'YourPassword',
guest: false,
},
logLevel: LOG_LEVELS.WARN,
});
The connection flow typically follows this sequence:
bot.init())bot.connect())bot.events.on('ready', async () => {
try {
// Find room by name
const roomInfo = await bot.getAddressFromRoomName('roomName');
console.log(`Found room: ${roomInfo.roomname}`);
// Set address and connect
bot.setAddress(roomInfo);
await bot.connect();
// Join with optional password
await bot.joinRoom({
password: 'optional-password',
});
} catch (error) {
console.error('Failed to join room:', error);
}
});
bot.events.on('ready', async () => {
try {
// Get room info from share link
const roomInfo = await bot.getAddressFromUrl('https://bonk.io/123abc');
console.log(`Found room: ${roomInfo.roomname}`);
// Connect to room
bot.setAddress(roomInfo);
await bot.connect();
await bot.joinRoom();
} catch (error) {
console.error('Failed to join room:', error);
}
});
bot.events.on('ready', async () => {
try {
// Connect to server first
await bot.connect();
// Then create room
bot.createRoom({
roomname: 'BonkBot Room',
maxplayers: 10,
roompassword: '',
hidden: true,
});
} catch (error) {
console.error('Failed to create room:', error);
}
});
// Get share link when room is created
bot.events.on('ROOM_SHARE_LINK', (data) => {
console.log(`Room created! URL: ${data.url}`);
});
| Event | Description | Returns |
|---|---|---|
ready | Bot is ready to connect | - |
connect | Connected to server | - |
PACKET | Any packet received | {type, ...data} |
JOIN | Joined a room | {game, room, players} |
PLAYER_JOIN | Player joined room | {player, id} |
PLAYER_LEAVE | Player left room | {player, id} |
CHAT_MESSAGE | Chat message received | {player, message} |
TEAM_CHANGE | Player changed team | {player, team} |
HOST_TRANSFER | Host was transferred | {oldHost, newHost} |
READY_CHANGE | Player ready status changed | {player, ready} |
GAME_START | Game started | - |
GAME_END | Game ended | - |
COUNTDOWN | Game countdown | {countdown} |
MAP_SWITCH | Map was switched | {map} |
MAP_SUGGEST | Map was suggested | {title, author, player} |
CHANGE_ROUNDS | Round count changed | {rounds} |
GAMEMODE_CHANGE | Game mode changed | {mode, engine} |
ROOM_SHARE_LINK | Room link created | {url} |
PLAYER_KICK | Player was kicked | player |
PLAYER_TABBED | Player tabbed in/out | {player, tabbed} |
PLAYER_INPUT | Player input received | {player, movement} |
TEAMLOCK_TOGGLE | Teams locked/unlocked | {teamsLocked} |
ROOM_NAME_UPDATE | Room name changed | {name} |
ROOM_ADDRESS | Room address updated | {address} |
BALANCE_SET | Player balance changed | {player, balance} |
disconnect | Disconnected from server | - |
// Chat message
bot.chat('Hello world');
// Get all players
const players = bot.getAllPlayers();
// Get host
const host = bot.getHost();
// Get room share link
const shareLink = bot.getShareLink();
// Set player ready status
bot.ready(true);
// Join a team (0-5)
bot.joinTeam(2); // 0=spectator, 1=FFA, 2=red, 3=blue...
// Give host to player
bot.giveHost(playerId);
// Kick a player
bot.kickPlayer(playerId);
// Leave the room
bot.leaveGame();
Check out the examples directory for more examples:
simple-bot.js: A basic bot that connects to a room and responds to chat commandshost-bot.js: A bot that creates and hosts a roomContributions are always welcome! If you find a bug or have a feature request, please open an issue on the project's GitHub page.
BonkBot is open-source software licensed under the GPL-3.0 License.
FAQs
A bonk.io botting library
We found that bonkbot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.