
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
This provides utility functions to use hull.io APIs within Node.js apps.
import Hull from 'hull';
const hull = new Hull({
id: 'YOUR_HULL_ID',
secret: 'YOUR_HULL_SECRET',
organization: 'YOUR_HULL_ORGANIZATION'
});
Once you have instanciated a client, you can use one of the get
, post
,
put
or delete
methods to perform actions of our APIs.
The first parameter is the route, the second is the set of parameters you want
to send with the request, the third is a callback.
//hull.api.get works too.
hull.get(path /*, params*/).then(function(data){
console.log(response);
},function(err, response){
console.log(err);
});
var user = hull.as('userId', true||false);
//second argument allows to specify wether we get the user's right or admin rights.
//Default is false: "get user rights".
user.get('/me')
user.userToken()
//user is an instance of Hull, scoped to a specific user. it will act as if the user performed the action
hull.configuration()
: Returns the global configurationhull.as(userId, sudo)
: create a new Hull client acting as the userhull.userToken({email:'xxx@example.com',name:'FooBar'}, claims)
: Creates a signed id for the user passed in hash. It allows to connect your own users to hull.io services. userHash needs an email
field. Read the docs about Bring your own usershull.currentUserId(userId, userSig)
: Checks the
validity of the signature relatively to a user idhull.currentUserMiddleware()
: Generates a middleware
to add to your Connect/Express apps. It will check if a user is onnected.hull.webhookMiddleware()
: Generates a middleware to answer to webhooks (deprecated, please use notifications instead)const app = express();
// a middleware with no mount path; gets executed for every request to the app
app.use(hull.currentUserMiddleware);
app.use(function(req,res,next){
console.log(req.hull.userId) // Should exist if there is a user logged in;
})
app.use(hull.webhookMiddleware);
//Responds to webhooks
app.use(function(req,res,next){
console.log(req.body) // Webhook payload, decrypted.
})
hull.as(userId, sudo).track(eventName, properties, context)
Stores a new event, which you can namespace using the source
property in the context
parameterhull.as(userId, sudo).trait(properties)
Stores Properties on the user.const sudo = true;
const userId = '12345';
hull.as(userId, sudo).track('new support ticket', {
messages: 3,
priority:'high'
}, {
source: 'zendesk',
ip: null, //don't store ip - it's a server call
referer: null, //don't store referer - it's a server call
created_at: '2013-02-08 09:30:26.123+07:00' //ISO 8601. moment.js does it very well
});
hull.as(userId, sudo).traits({
hometown: 'paris'
});
Your app can subscribe to events from Hull and receive notifications via http POST.
const app = express();
import { NotifHandler } from 'hull';
const handler = NotifHandler({
onSubscribe() {} // called when a new subscription is installed
onError() {} // called when an error is raised
events: {
'user_report:update' : function(notif, context) {
console.warn('Event Handler here', notif, context);
// notif: {
// message: { id: '123', ... },
// subject: 'user_report:update',
// timestamp: "2016-02-03T17:01:57.393Z' }
// }
// context: {
// hull: <Instance of Hull Client>
// ship: <Current ship instance if available>,
// req: < Original request, Useful to retreive additional data>
// }
}
}
})
app.post('/notify', handler);
FAQs
A Node.js client for hull.io
The npm package hull receives a total of 118 weekly downloads. As such, hull popularity was classified as not popular.
We found that hull demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.