
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
usage in koa js
$ npm i lodash nodemailer
config.yaml
server:
protocol: http
hostname: localhost
port: 5000
email:
service: gmail
auth:
user: 'mailer@email.com'
pass: yourpassword
const Koa = require('koa')
const app = new Koa()
const mailer = require('mailon')
const { server, email } = require('config')
app.use(mailer(email, __dirname + '/public'))
/* SERVER */
app.listen(server.port, () => {
const http = require('url').format(server)
console.log(`server running at: ${http}`)
})
async requestPasswordRecovery(ctx){
const code = await ctx.state.$user.newPasswordRecoveryCode()
if(!code) ctx.cargo.original(ctx.request.body).state('validation')
.loadmsg('code', 'invalid code').error(422)
await ctx.mailer
.to(ctx.state.$user.email)
.subject('Password Revocery Code')
.body(ctx.template.render('email-verification.html', code))
.send()
ctx.body = ctx.cargo.msg(`password recovery email sent to ${ctx.state.$user.email}`)
}
Mailon is a templating engine for tempate emails.
Create a template folder anywhere in your project folder. All template files should end in .html
. We should stick to the following naming convention filename.langcode.html
. The langcode will be used to retrieve the correct translation of the email if your app supports it.
Example Filenames
const exampleFileNameEnglish = 'welcome.en.html'
const exampleFileNameChinese = 'welcome.zh.html'
Example Welcome Email in English: welcome.en.html
<h1>Welcome to company.name</h1>
<p>you have created a new account, below are your account credentials:</p>
<ul>
<li>username: ${user.username}</li>
<li>password: ${user.password}</li>
</ul>
For more information please click <a href="${link}">here</a>
Example Welcome Email in Chinese: welcome.en.html
<h1>账户主次成功</h1>
<p>下边是您账户信息:</p>
<ul>
<li>用户名: ${user.username}</li>
<li>密码: ${user.password}</li>
</ul>
更多信息, 请按<a href="${link}">here</a>
const { mailon } = require('./mailmap')
const instance = mailon('path-where-you-store-your-templates')
instance.langTo('zh')
instance.get('welcome', data)
output
<h1>账户主次成功</h1>
<p>下边是您账户信息:</p>
<ul>
<li>用户名: some-username</li>
<li>密码: some-password</li>
</ul>
更多信息, 请按<a href="some-link">here</a>
Note: if you wish to set the langue you will have set a lang property on your request object before instantiating notis.
const mailon = require('./mailmap')('path-where-you-store-your-templates')
// mount to express app
app.use(mailon())
// accessing in express route
const SomeExpressRoute = async (req, res, next) => {
const data = {
user: { ... },
invoice: { ... }
}
const email = req.mailon.get('some-email-template', data)
next()
}
FAQs
#### V2 usage in koa js 1. <code>$ npm i lodash nodemailer</code>
The npm package mailon receives a total of 1 weekly downloads. As such, mailon popularity was classified as not popular.
We found that mailon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.