
Research
/Security News
Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
A long-running Go typosquat impersonated the popular shopspring/decimal library and used DNS TXT records to execute commands.
京东联盟Nodejs SDK
npm i -save jd-union
// or
yarn add jd-union
整个导入
const JdUnion = require('jd-union');
按需导入
const {create, sign, request} = require('jd-union');
创建Api实例
const {create} = require('jd-union');
const api = create(
{
appKey: '<联盟分配给应用的appKey>如:eefc33bDRea044cb8ctre5hycf0ac1934',
appSecret: '<联盟分配给应用的appSecret>如:6d34r0d0kild46460654b42f5e350982'
} // 0.3.x版本后,不再支持自定义服务地址
);
// 调用Api
// api.request(API接口名称, 业务参数); 返回promise
const res = await api.request(
'jd.union.open.goods.jingfen.query',
{
goodsReq: {
eliteId: 22
}
},
'1.0',
''
);
// 验签
const signature = api.sign(
{
method: 'jd.union.open.goods.jingfen.query',
'360buy_param_json': {
goodsReq: {
eliteId: 22
}
}, // 0.3.x版本后,key仅支持360buy_param_json
v: '1.0',
access_token: '',
timestamp: '2018-10-18 11:13:12',
sign_method: 'md5',
format: 'json'
}
);
console.log(signature);
单独验签
const {sign} = require('jd-union');
const signature = sign(
{
method: 'jd.union.open.goods.jingfen.query',
'360buy_param_json': {
goodsReq: {
eliteId: 22
}
}, // 0.3.x版本后,key仅支持360buy_param_json
v: '1.0',
access_token: '',
timestamp: '2018-10-18 11:13:12',
sign_method: 'md5',
format: 'json'
},
'eefc33bDRea044cb8ctre5hycf0ac1934',
'6d34r0d0kild46460654b42f5e350982'
);
console.log(signature);
单独调用Api
const {request} = require('jd-union');
/*
const res = await request(
API接口名称,
业务参数,
Api版本号,
access_token = '',
'<联盟分配给应用的appKey>如:eefc33bDRea044cb8ctre5hycf0ac1934',
'<联盟分配给应用的appSecret>如:6d34r0d0kild46460654b42f5e350982'
);
*/
const res = await request(
'jd.union.open.goods.jingfen.query',
{
goodsReq: {
eliteId: 22
}
},
'1.0',
'',
'eefc33bDRea044cb8ctre5hycf0ac1934',
'6d34r0d0kild46460654b42f5e350982'
);
FAQs
京东联盟SDK
The npm package jd-union receives a total of 6 weekly downloads. As such, jd-union popularity was classified as not popular.
We found that jd-union demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A long-running Go typosquat impersonated the popular shopspring/decimal library and used DNS TXT records to execute commands.

Research
Active npm supply chain attack compromises @antv packages in a fast-moving malicious publish wave tied to Mini Shai-Hulud.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.