
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
express-slack
Advanced tools
const {PORT, SCOPE, TOKEN, CLIENT_ID, CLIENT_SECRET} = process.env,
slack = require('express-slack'),
express = require('express'),
app = express();
// the path for OAuth, slash commands, and event callbacks
app.use('/slack', slack({
scope: SCOPE,
token: TOKEN,
store: 'data.json'
client_id: CLIENT_ID,
client_secret: CLIENT_SECRET
}));
// handle the "/test" slash commands
slack.on('/test', (payload, bot) => {
bot.reply('works!');
});
app.listen(PORT, () => {
console.log(`Server started on ${PORT}`);
});
const slack = require('express-slack'),
express = require('express'),
app = express();
app.use('/slack', slack({
scope: 'bot,commands',
token: 'gIkuvaNzQIHg97ATvDxqgjtO',
store: 'data/team.json'
client_id: 'XXXXXXXXXXXX',
client_secret: 'XXXXXXXXXXXX'
}));
Argument | Description |
---|---|
scope | The Slack OAuth scope to request |
client_id | The Slack OAuth Client Id code |
client_secret | The Slack OAuth Client Secret code |
token | The Slack Verification Token (optional) |
store | A string path to a filestore or a custom store object |
// handle RTM messages
slack.on('message', (payload, bot) => { });
// handle all slash commands
slack.on('slash_command', (payload, bot) => { });
// handle the outgoing webhooks trigger word "googlebot"
slack.on('googlebot', (payload, bot) => { });
// handle multiple events
slack.on('googlebot', '/test', 'slash_command', (payload, bot) => { });
// wildcard support
slack.on('*', (payload, bot) => { });
Event | Description |
---|---|
***** | All events |
message | All RTM events |
slash_command | All Slash Commands |
event | All Event API callbacks |
webhook | All WebHook callbacks |
interactive_message | All Interactive message callbacks |
[/command] | Any specific slash command |
[event type] | Any specific event type |
[trigger word] | Any trigger from outgoing webhooks |
Bots are preloaded with the appropriate token and are context aware. So you can reply to messages and send ephemeral updates to a message.
slack.on('message', (payload, bot) => {
bot.replyPrivate('loading...');
bot.reply({
text: 'Everything is working!',
attachments: [{
title: "Slack API Documentation",
title_link: "https://api.slack.com/",
text: "Optional text that appears within the attachment",
fields: [{
title: "Priority",
value: "High",
short: false
}]
}]
});
// the token is already set
bot.send('channels.info', { channel: 'C1234567890' }).then(data => {
// results from API call
});
});
Methods | Description |
---|---|
say | Send a message |
reply | Send a public reply to the event |
replyPrivate | Send an ephemeral reply to the event |
send | Call any Slack API endpoint |
A key/value store to maintain team/bot information and store custom setings. The store follows the same interface of a single BotKit Store
slack.store.all().then(results => {
// list of all items
});
slack.store.get(id).then(record => {
// return a single record by key
});
Methods | Description |
---|---|
get | Get a single record by id |
all | Get all saved records |
save | Save a record |
The Slack client is a way to call the API outside of an event.
let message = {
unfurl_links: true,
channel: 'C1QD223DS1',
token: 'xoxb-12345678900-ABCD1234567890',
text: "I am a test message http://slack.com",
attachments: [{
text: "And here's an attachment!"
}]
}
// send message to any Slack endpoint
slack.send('chat.postMessage', message).then(data => {
// Success!
});
// respond to webhooks
slack.send('https://hooks.slack.com/services/T0000/B000/XXXX', message);
// create an instance with defaults
let instance = slack.client({
unfurl_links: true,
channel: 'C1QD223DS1',
token: 'xoxb-12345678900-ABCD1234567890'
});
let message = {
text: "I am a test message http://slack.com",
attachments: [{
text: "And here's an attachment!"
}]
};
// send message to any Slack endpoint
instance.send('chat.postMessage', message);
FAQs
Express middleware to handle Slack requests
The npm package express-slack receives a total of 0 weekly downloads. As such, express-slack popularity was classified as not popular.
We found that express-slack demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.