
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
linkedin-exchange-tokens
Advanced tools
A simple function to convert from LinkedIn JS API Tokens to long-lived OAuth 1.0 tokens
A simple function to exchange the short-lived OAuth2 token provided by the LinkedIn JSAPI to a long-lived OAuth token that can be used by the server to make REST api calls.
This mechanism is described in this linked-in documentation
This module also has a way to make REST API calls to linked in though that can be done using other modules as well.
npm install linkedin-exchange-tokens
var exchangeTokens = require('linkedin-exchange-tokens');
var options = {
'public': 'Your Linked In API Key',
'secret': 'Your Linked In API Secret'
};
// now assume your browser JS code calls the server with its OAuth2 token
// alternatively, this could be from OAuth2 passportjs flow
var oauth2Token = '<token from browser JSAPI: for example: IN.ENV.auth.oauth_token>';
exchangeTokens(options, oauth2Token, function (err, tokenInfo) {
// now tokenInfo is the oauth1 token info
// {
// 'public': 'auth_token',
// secret: 'oauth_token_secret',
// expires: 'time when token expires'
// }
// You can use this to make rest calls as follows
tokenInfo.api('/v1/people/~/connections, {}, function (err, info) {
// boom!
});
});
You can also make REST calls with this API using OAuth1.0 tokens.
var exchangeTokens = require('linkedin-exchange-tokens');
var options = {
'public': 'Your Linked In API Key',
'secret': 'Your Linked In API Secret'
};
// assume you have saved the tokenInfo from the previous example
// into the database and want to use it to make REST calls later
exchangeTokens.makeTokenInfo(options, tokenInfo)
.api('/v1/people/~/connections', {}, function (err, info) {
// boom!
});
You can pass the linked in API key and secret via environment variables instead of via the options parameter.
FAQs
A simple function to convert from LinkedIn JS API Tokens to long-lived OAuth 1.0 tokens
The npm package linkedin-exchange-tokens receives a total of 0 weekly downloads. As such, linkedin-exchange-tokens popularity was classified as not popular.
We found that linkedin-exchange-tokens demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.