
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
linkedin-exchange-tokens
Advanced tools
A simple function to convert from LinkedIn JS API Tokens to long-lived OAuth 1.0 tokens
A simple function to exchange the short-lived OAuth2 token provided by the LinkedIn JSAPI to a long-lived OAuth token that can be used by the server to make REST api calls.
This mechanism is described in this linked-in documentation
This module also has a way to make REST API calls to linked in though that can be done using other modules as well.
npm install linkedin-exchange-tokens
var exchangeTokens = require('linkedin-exchange-tokens');
var options = {
'public': 'Your Linked In API Key',
'secret': 'Your Linked In API Secret'
};
// now assume your browser JS code calls the server with its OAuth2 token
// alternatively, this could be from OAuth2 passportjs flow
var oauth2Token = '<token from browser JSAPI: for example: IN.ENV.auth.oauth_token>';
exchangeTokens(options, oauth2Token, function (err, tokenInfo) {
// now tokenInfo is the oauth1 token info
// {
// 'public': 'auth_token',
// secret: 'oauth_token_secret',
// expires: 'time when token expires'
// }
// You can use this to make rest calls as follows
tokenInfo.api('/v1/people/~/connections, {}, function (err, info) {
// boom!
});
});
You can also make REST calls with this API using OAuth1.0 tokens.
var exchangeTokens = require('linkedin-exchange-tokens');
var options = {
'public': 'Your Linked In API Key',
'secret': 'Your Linked In API Secret'
};
// assume you have saved the tokenInfo from the previous example
// into the database and want to use it to make REST calls later
exchangeTokens.makeTokenInfo(options, tokenInfo)
.api('/v1/people/~/connections', {}, function (err, info) {
// boom!
});
You can pass the linked in API key and secret via environment variables instead of via the options parameter.
FAQs
A simple function to convert from LinkedIn JS API Tokens to long-lived OAuth 1.0 tokens
The npm package linkedin-exchange-tokens receives a total of 2 weekly downloads. As such, linkedin-exchange-tokens popularity was classified as not popular.
We found that linkedin-exchange-tokens demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.