
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
ebics-client
Advanced tools
Pure Node.js (>= 16) implementation of EBICS (Electronic Banking Internet Communication).
The client is aimed to be 100% ISO 20022 compliant, and supports the complete initializations process (INI, HIA, HPB orders) and HTML letter generation.
For examples on how to use this library, take a look at the examples.
The latest Node.js versions don't support RSA_PKCS1_PADDING for private decryption for security reasons, throwing an error like TypeError: RSA_PKCS1_PADDING is no longer supported for private decryption, this can be reverted with --security-revert=CVE-2023-46809.
EBICS requires this mode, so in order for this library to work, add the following parameter when starting Node.js: --security-revert=CVE-2023-46809
Create a configuration (see example configs) with the EBICS credentials you received from your bank and name it in this schema: config.<environment>.<bank>[.<entity>].json (the entity is optional).
url, partnerId, userId, hostId are provided by your bank.passphrase is used to encrypt the keys file, which will be stored at the storageLocation.bankName and bankShortName are used internally for creating files and identifying the bank to you.languageCode is used when creating the Initialization Letter and can be either de, en, or fr.Run node examples/initialize.js <environment> <bank> [entity] to generate your key pair and perform the INI and HIA orders (ie. send the public keys to your bank)
The generated keys are stored in the file specified in your config and encrypted with the specified passphrase.
Run node examples/bankLetter.js <environment> <bank> [entity] to generate the Initialization Letter
Print the letter, sign it and send it to your bank. Wait for them to activate your EBICS account.
Download the bank keys by running node examples/save-bank-keys.js <environment> <bank> [entity]
If all these steps were executed successfully, you can now do all things EBICS, like fetching bank statements by running node examples/send-sta-order.js <environment> <bank> [entity], or actually use this library in your custom banking applications.
The client is currently tested and verified to work with the following banks:
The basic concept of this library was inspired by the EPICS library from the Railslove Team.
Copyright: Dimitar Nanov, 2019-2022.
Licensed under the MIT license.
FAQs
Node.js ISO 20022 Compliant EBICS Client
The npm package ebics-client receives a total of 573 weekly downloads. As such, ebics-client popularity was classified as not popular.
We found that ebics-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.