Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
homebridge-wiz-lan
Advanced tools
Based off of kpsuperplane/homebridge-iotas
Make sure your bulbs are already set up via the Wiz app and you have "Allow Local Communication" set to ON in your settings.
npm install -g homebridge
npm install -g homebridge-wiz-lan
Simple Configuration:
{
"platform": "WizSmarthome",
"name": "WizSmarthome",
}
Full configuration options:
{
"platform": "WizSmarthome",
"name": "Wiz",
// [Optional] Port for bulbs to connect to your server
// Default: 38900
"port": 38900,
// [Optional] Enable scenes support for your bulbs
// Default: false
"enableScenes": false,
// [Optional] Lights turn on with the same settings they had when turned off (light configs in HomeKit are ignored).
// Default: false
"lastStatus": false,
// [Optional] UDP Broadcast address for bulb discovery
// Default: 255.255.255.255
"broadcast": "255.255.255.255",
// [Optional] Your server's IP address
// Default: Autodiscovered
"address": "192.168.0.1",
// [Optional] Manual list of IP addresses of bulbs
// Useful if UDP broadcast doesn't work for some reason
// Default: None
"devices": [
{ "host": "192.168.0.2" },
{ "host": "192.168.0.3" },
{ "host": "192.168.0.4" },
// ...
],
// [Optional] Refresh/ping every accessory to get their latest state on an interval. Specify in seconds, 0 = off
// Default: 0
"refreshInterval": 60,
}
The Wiz bulbs strongly distinguish between RGB color modes and Kelvin color modes, the latter being significantly brighter. Unfortunately, HomeKit is not very good at handling both at the same time, yielding weird errors if you try to add both characteristics.
Luckily, even if we only enable the color mode, we still get a nice temperature picker. Problem is, the color temperature is given in standard HSV. As such, this app will try to guess which one to best use given a color, and you will notice some significant brightness variance switching between a "temp" hue and a "color" hue.
In particular, since the Wiz bulbs only support up to 6500K, this means that only the top-ish half of the temperature picker is actually bright
If a "rhythm" is selected in the Wiz app and lastStatus
is set to true
, the lights will always turn on to the rhythm. When rhythms are disabled, lights turn on to whatever setting they had when last turned off.
Ideas from http://blog.dammitly.net/2019/10/cheap-hackable-wifi-light-bulbs-or-iot.html?m=1
Thanks to:
#7 Remove obsolete/invalid parameters from setPilot to fix
#16 Support costco wiz lights that behave differently from philips wiz
#25 Fix: getter for Name Characteristic returned object instead of the value
#57 transform the received dimming value to also fit the 10 to 100 range
#67 feat: Support durable custom names in config
#74 feat: implement dynamic scenes selector
#119 Add lastStatus setting so lights remember their setting when turned on
#118 Added support for Wiz Smart Plug ESP25_SOCKET_01
Mostly built for my own personal use, I'll probably reply to any created issues but probably will not actively support anything outside of the RGB bulbs. If you'd like to make a PR through, <3
Furthermore, feel free to create and modify it on your own per MIT License.
Make a UDP broadcast to port 38899 with the following content:
{"method":"registration","params":{"phoneMac":"<my_mac_address>","register":false,"phoneIp":"<my_ip_address>"}}
You will get a response on port 38900 with the following content:
{"method":"registration","env":"pro","result":{"mac":"<light_address>","success":true}}
See LICENSE file
FAQs
A homebridge plugin to control Wiz Lights
The npm package homebridge-wiz-lan receives a total of 281 weekly downloads. As such, homebridge-wiz-lan popularity was classified as not popular.
We found that homebridge-wiz-lan demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.