Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
A fun little IRC bot library for node.js. Ridiculously simple to set-up and get going!
Seriously, it's stupidly simple.
Firstly, we'll need to grab Jerk. If you use npm it's as easy as:
npm install jerk
If you prefer straight-up git:
git clone git://github.com/gf3/Jerk.git
Hoo haa, now that we're locked and loaded, let's write a goddamn bot! We need to include Jerk:
var jerk = require( 'jerk' )
You'll need some options
. Jerk takes the exact same options object as the IRC-js library. Let's just go ahead and supply some basic info:
var options =
{ server: 'irc.freenode.net'
, nick: 'YourBot9001'
, channels: [ '#your-channel' ]
}
Hah, now you're going to cry once you see how easy this is:
jerk( function( j ) {
j.watch_for( 'soup', function( message ) {
message.say( message.user + ': soup is good food!' )
})
j.watch_for( /^(.+) are silly$/, function( message ) {
message.say( message.user + ': ' + message.match_data[1] + ' are NOT SILLY. Don\'t joke!' )
})
}).connect( options )
Really. That's it.
The jerk object (j
) has only one method: watch_for
. Which takes two arguments, the first can be either a string or a regex to match messages against. The second argument is your hollaback function for when a match is found. The hollaback receives only one argument, the message
object. It looks like this:
{ user: String
, source: String
, match_data: Array
, say: Function( message )
, msg: Function( message )
}
One thing I will tell you though, is the say
method is smart enough to reply to the context that the message was received, so you don't need to pass it any extra info, just a reply :) However, the msg
method can be used if you'd like to force sending a message directly to a user (aka a PM).
The connect
method returns an object with some handy methods that you can use outside of your watch_for
s:
{ say: Function( destination, message )
, action: Function( destination, action )
, forget: Function( pattern )
, part: Function( channel )
, join: Function( channel )
, quit: Function( message )
}
Example:
var superBot = jerk( ... ).connect( options )
// Later...
superBot.say( '#myChan', 'Soup noobs?' )
superBot.join( '#haters' )
superBot.action( '#hates', 'hates all of you!' )
I think everything there is pretty self-explanatory, no?
node yourBot9001.js
Run your bot on a remote server:
nohup node yourBot9001.js &
Although I recommend using something like forever to keep your bot running for a while.
Done.
Here's a more practical example, meet protobot. Protobot hangs out on Freenode#prototype all day – stop by and say hi!
A few bots using Jerk:
Wrote a bot with Jerk? Email me and I'll add it to the list!
{ "author" : "Gianni Chiappetta <gianni@runlevel6.org> (http://gf3.ca)"
, "contributors" :
[ "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)"
, "Arnaud Berthomier <oz@cyprio.net> (http://wtf.cyprio.net)"
, "Suresh Harikrishnan <suresh.harikrishnan@gmail.com> (http://www.activesphere.com)"
, "Tomás Senart <tsenart@me.com> http://about.me/tsenart"
]
}
Jerk is UNLICENSED.
FAQs
Stupidly simple IRC bots in Javascript.
The npm package jerk receives a total of 9 weekly downloads. As such, jerk popularity was classified as not popular.
We found that jerk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.