Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
jkeveren-spotify-api
Advanced tools
Promise based Spotify API wrapper that automatically refreshes access tokens
npm install jkeveren-spotify-api
Both unit and integration (requires configuration) tests can be run using npm test
.
Unit tests can be run using npm run test/unit
.
Integration tests communicate with Spotify's API so requires some configuration.
Once configured, integration tests can be run using npm run test/integration
.
http://localhost:<port>
where <port>
is the same as REDIRECT_SERVER_PORT
in the .env file that you will create in the next step..env
file inside the test-integration
directory. Copy and modify following variables:# Port for the redirect server to listen on
# The integration suite starts a temporary server for Spotify to redirect to.
# This is the port that it listens on
REDIRECT_SERVER_PORT=8000
# Base URLs for auth and API.
# Documneted in Spotify's API docs:
# Auth: https://developer.spotify.com/documentation/general/guides/authorization/
# API: https://developer.spotify.com/documentation/web-api/reference/#/
# Typical values are as follows:
AUTH_BASE_URL=https://accounts.spotify.com
API_BASE_URL=https://api.spotify.com/v1
# Client credentials
# Copy these from you're spotify app in the Spotify developer dashboard:
# https://developer.spotify.com/dashboard
CLIENT_ID=999b871166be415590457fc76f5898b4
CLIENT_SECRET=c2df8bfbbd8044b2b87899fe451615f6
FAQs
Promise based Spotify API wrapper that automatically refreshes access tokens
The npm package jkeveren-spotify-api receives a total of 14 weekly downloads. As such, jkeveren-spotify-api popularity was classified as not popular.
We found that jkeveren-spotify-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.