Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
kotori-bot
Advanced tools
KotoriBot是一个go-cqhttp的基于NodeJS+TypeScript的SDK和QQ机器人框架实现,相比于其它的go-cqhttp的NodeJS实现,Kotori-Bot的最大特点便是完全由纯TypeScript语言开发
Kotori是一个罗马字,在日语中是ことり(小鳥)的意思,该名字取自于Key品牌Galgame《Rewrite》及其衍生作品中的登场角色及主要女性角色之一的神户小鸟(神戸(かんべ) 小鳥(ことり))。
糊狸博客:imlolicon.tk
go-cqhttp是基于 Mirai 以及 MiraiGo 的 OneBot Golang 原生实现 go-cqhttp官网:https://docs.go-cqhttp.org/
下载后运行选择连接方式(推荐WSReverse反向)生成配置文件和bat,填好QQ(不用填密码)和连接地址等信息,运行bat后生成device.json
文件,将protocol
(登陆协议)改成2
(手表),即可使用手机QQ扫码登录
Tips:请先安装NodeJS环境和NPM或Git(可选)
NPM安装
npm install kotori-bot
Git安装
git clone https://github.com/BIYUEHU/kotori-bot.git
手动下载安装 点击下载源码
下载完成后,在根目录运行以安装所有依赖库
npm install
首先配置config.yml
的相关参数,需与Go-cqhttp的配置一致
connect:
# 连接模式 可选: http ws ws-reverse 推荐首选ws-reverse
mode: ws-reverse
# Go-cqhttp里设置的访问密钥 未设置则忽略(暂未支持)
access-token: ''
# Http正反向(暂未支持)
http:
url: "http://localhost" # 正向Http地址
port: 8888 # 正向Http端口
reverse-port: 8080 # 反向Http端口
retry-time: 10 # 同上
# WebSocket正向
ws:
url: "ws://localhost" # WS地址
port: 8888 # WS端口
retry-time: 10 # 连接断开或失败时尝试重连间隔时间 单位:秒
# WebSocket反向(相对于Gocqhttp)
ws-reverse:
port: 8080 # WS反向端口
# 暂未实现
bot:
# 机器人主人QQ号(拥有调试权限)
master: 123
# 指令列表
command-list:
reload: /reload # 热重载所有插件
运行
npm run start
或
ts-node ./src/app.ts
如果你想将KotoriBot作为一个NPM包或者说node项目库来导入到你自己的项目使用搭建机器人的话,由于TS语言本身的原因,无法直接导入纯TypeScript项目,需要先构建一遍TS源码
npm run build
构建完成后的文件将生成在dist/
文件下,但你无需顾忌这么多,直接引入即可
TypeScript(.ts)
import Kotori from "kotori-bot";
const Bot = new Kotori({
mode: 'WsReverse',
port: 8080
}, (Event: any, Api: any) => {
/* ... */
});
Bot.create();
JavaScript With CommonJS(.js .cjs)
const Kotori = require("kotori-bot");
const Bot = new Kotori({
mode: 'WsReverse',
port: 8080
}, (Event, Api) => {
/* ... */
});
Bot.create();
JavaScript With ESModule(.cjs)
import Kotori from "kotori-bot";
//...
该方式下运行不会读取项目下的配置文件,需在实例化时传入配置参数,详细说明参考
将插件根文件夹或单文件放置在plugins/
,Kotori会自动加载该目录下的所有相关文件
KotoriBot插件收集:https://github.com/BIYUEHU/kotori-bot/tree/plugins
该仓库分支专用于收集插件,将不定期更新,你可以直接通过Pull Request的方式将你的插件加入(或更新时)到仓库并更新该分支下README.md
中的插件列表信息,亦或直接提供你发现的KotoriBot插件
FAQs
Cross-platform chatbot framework base on Node.js and TypeScript
The npm package kotori-bot receives a total of 74 weekly downloads. As such, kotori-bot popularity was classified as not popular.
We found that kotori-bot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.