Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
emailjs-smtp-client
Advanced tools
SMTP Client allows you to connect to and stream data to a SMTP server in the browser.
Installation: npm install emailjs-smtp-client
Create SmtpClient
object with:
import SmtpClient from 'emailjs-smtp-client'
var client = new SmtpClient(host, port, options)
where
The following connection options can be used with simplesmtp.connect
:
"PLAIN"
for using AUTH PLAIN
or "XOAUTH2"
for AUTH XOAUTH2
)Default STARTTLS support is opportunistic – if the server advertises STARTTLS in EHLO response, the client tries to use it. If STARTTLS is not advertised, the clients sends passwords in the plain. You can use ignoreTLS
and requireTLS
to change this behavior by explicitly enabling or disabling STARTTLS usage.
To authenticate using XOAUTH2, use the following authentication config
var config = {
auth: {
user: 'username',
xoauth2: 'access_token'
}
}
See XOAUTH2 docs for more info.
Once a connection is set up the following events can be listened to:
onidle
is emitted again.(failedRecipients)
- the envelope is passed successfully to the server and a message stream can be started. The argument is an array of e-mail addresses not accepted as recipients by the server. If none of the recipient addresses is accepted, onerror
is emitted instead.(success)
- the message was sent(err)
- An error occurred. The connection will be closed shortly afterwards, so expect an onclose
event as well(isError)
- connection to the client is closed. If isError
is true, the connection is closed because of an errorExample:
client.onidle = function(){
console.log("Connection has been established");
// this event will be called again once a message has been sent
// so do not just initiate a new message here, as infinite loops might occur
}
When an onidle
event is emitted, an envelope object can be sent to the server.
This includes a string from
and a single string or an array of strings for to
property.
Envelope can be sent with client.useEnvelope(envelope)
// run only once as 'idle' is emitted again after message delivery
var alreadySending = false;
client.onidle = function(){
if(alreadySending) return
alreadySending = true
client.useEnvelope({
from: "me@example.com",
to: ["receiver1@example.com", "receiver2@example.com"]
})
}
The to
part of the envelope must include all recipients from To:
, Cc:
and Bcc:
fields.
If envelope setup up fails, an error is emitted. If only some (not all)
recipients are not accepted, the mail can still be sent. An onready
event
is emitted when the server has accepted the from
and at least one to
address.
client.onready = function(failedRecipients){
if(failedRecipients.length){
console.log("The following addresses were rejected: ", failedRecipients)
}
// start transfering the e-mail
}
When onready
event is emitted, it is possible to start sending mail. To do this
you can send the message with client.send
calls (you also need to call client.end()
once
the message is completed).
send
method returns the state of the downstream buffer - if it returns true
, it is safe to send more data, otherwise you should (but don't have to) wait for the ondrain
event before you send more data.
NB! you do not have to escape the dots in the beginning of the lines by yourself (unless you specificly define so with disableEscaping
option).
client.onready = function(){
client.send("Subject: test\r\n");
client.send("\r\n");
client.send("Message body");
client.end();
}
Once the message is delivered an ondone
event is emitted. The event has an
parameter which indicates if the message was accepted by the server (true
) or not (false
).
client.ondone = function(success){
if(success){
console.log("The message was transmitted successfully");
}
}
Once you have done sending messages and do not want to keep the connection open, you can gracefully close the connection with client.quit()
or non-gracefully (if you just want to shut down the connection and do not care for the server) with client.close()
.
If you run quit
or close
in the ondone
event, then the next onidle
is never called.
STARTTLS
is currently not supportedPLAIN
, USER
and XOAUTH2
authentication mechanisms are supported. XOAUTH2
expects a ready to use access token, no tokens are generated automatically.Copyright (c) 2013 Andris Reinman
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
SMTP Client allows you to connect to an SMTP server in JS.
We found that emailjs-smtp-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.