
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Le Poste
A simple interface to send emails.
To install this npm
package do
npm i le-poste
This package is interesting if you are using a dependency injector like di-why
, combined with dotenv
to just plug the env variables and play. So this will describe usage along with these two packages.
Go to your usual loaders
directory index.ts
and import mailInjectionDict
// your-project/src/loaders/index.ts
import DiContainer from 'di-why';
// import any other dict elements ...
// and
import { mailInjectionDict } from 'le-poste';
const injectionDict = {
// somePackageLoadDict,
// etc.,
// finally inject all le-poste's loaders into the main loadDict
...mailInjectionDict,
};
const di = new DiContainer({ logger, load: injectionDict });
export default di;
Now you can go anywhere in your code and import the index file above:
import di from `./loaders`;
try {
await di.loadAll();
const mailSend = di.get('mailSend');
await mailSend({ subject: "le poste is open", text: "Tu reçois my message" });
} catch (e) {
console.log('Some error occurred', e);
}
Lots of magic happening here, thanks to di-why
and the mailInjectionDict
we imported. That's why you need not pass user
, password
, port
and transporter
stuff in order to send a message.
A question emerges, how do we pass the connection data to mailSend
? We don't do it directly. Read on.
In order to configure mailSend, we need to be using dotenv
, or add some properties to process.env
. They are the following:
MAIL_SMTP_HOST=mail.yourmailprovider.com
MAIL_SMTP_PORT=465
MAIL_FROM_NAME="Jean Jacques"
MAIL_USER=jj@cousteau.com
MAIL_ADMIN_TO_COMMA_LIST="Notify Me Aswell" <admin@cousteau.com>
MAIL_TO_COMMA_LIST="Le phare" <le@phare.com>
MAIL_PASSWORD='s0meR4nd0mCh4r5'
FAQs
a mail wrapper to forget about essential details of life
The npm package le-poste receives a total of 42 weekly downloads. As such, le-poste popularity was classified as not popular.
We found that le-poste demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.