Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
calamarble-xhub-sns
Advanced tools
check the signature of a http request and if valid post to an AWS SNS topic
Checks the signature of a http request and if valid post the body of the request to a configurable existing AWS SNS topic.
import express from 'express';
import bodyParser from 'body-parser';
import { apiEndpoint } from 'calamarble-xhub-sns';
const expressConfig = {
port: 8088,
postPath: '/mywebhook',
messages: {
serverRunning: port => `Server running on port ${port}`
}
};
const xHubSnsConfig = {
algo: 'sha1',
secret: 'MY_APP_SECRET',
topicArn: 'arn:aws:sns:us-east-1:XXXXX:yyyyy',
awsConfig: {
region: 'us-east-1'
}
messages: {
wrongSignature: 'Content signature don\'t match'
}
};
const app = express();
const postEndPoint = apiEndpoint(xHubConfig);
app.use(bodyParser.raw({ type: 'application/json' }));
app.post(expressConfig.postPath, postEndPoint);
app.listen(expressConfig.port, () => console.log(`Server running on port ${expressConfig.port}`));
import ApiBuilder from 'claudia-api-builder';
import { apiEndpoint as webhookPost} from 'calamarble-xhub-sns';
const api = new ApiBuilder();
const xHubConfig = {
algo: 'sha1',
secret: 'MY_APP_SECRET',
topicArn: 'arn:aws:sns:us-east-1:XXXXX:yyyyy',
messages: {
wrongSignature: 'Content signature don\'t match'
}
}
api.post('/fbwebhook', webhookPost(xHubConfig));
export { api as default };
Remember to copy the file policies/sns-publish.json
and include it in your
claudia create --policies
command line argument when creating your lambdas.
FAQs
check the signature of a http request and if valid post to an AWS SNS topic
The npm package calamarble-xhub-sns receives a total of 0 weekly downloads. As such, calamarble-xhub-sns popularity was classified as not popular.
We found that calamarble-xhub-sns demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.