
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
messenger-personal-api
Advanced tools
Hacky solution for receiving messages on personal accounts
Why hacky? messenger-personal-api
is an Electron app that extracts messages from Messenger.com's DOM... so not optimal, but working solution.
npm install messenger-personal-api --save
You will need to have electron
package installed as well.
import { MessengerAPI } from 'messenger-personal-api'
const api = new MessengerAPI({
email: 'your@email.com',
pass: 'SuperSecretPassword'
})
api.start()
api.on('new_message', message => {
console.log(`${message.sender}: ${message.content}`)
})
electron .
You will need to run your program as an Electron app.
TIP: If you need the API for non-electron app, you can build a very simple http(s) server on Electron and let it send POST requests to your app.
If you initialize the API with both e-mail and password, user will be logged in automatically.
If you only fill in the e-mail, you'll be prompted to type in your password securely via HTTPS connection to Messenger.com.
Password encryption will hopefully be implemented in future versions of the API.
const api = new MessengerAPI({
email: 'your@email.com',
// Hard-code your password only if
// you don't distribute this piece of app
// where it could get decompiled
pass: 'SuperSecretPassword'
})
// Simply start the API
api.start()
// Or start and listen to useful messages
// (e.g. logged in, couldn't log in etc)
api.start((err, message) => {
if (err) {
console.error(err.content)
} else {
console.log(message)
}
})
api.on('new_message', message => {
// new message object
})
All messages are sent to you as objects, e.g.:
{
type: 'text',
date: 1496966580162, // Date in UTC format
sender: 'Your Friend',
sender_id: '1032752459',
content: 'Chill out my friend 😎'
}
type:
text
Returns plain text with emojis in content
image
Returns URL of the image/s in content
video
Returns URL of the video in content
attachment
Returns URL of the attached file in content
thumbs_up
Returns 👍 in content
sticker
Returns URL of the sticker in content
huge_emoji
Returns URL of the inflated emoji in content
gif
Returns the GIF URL in content
link
Returns the link from featured tab in content
voice
Currently can't retrieve the actual message.
These are some points that need few hours of work:
thread_info.php
)So if you're awesome and want to contribute to this project, go fork, clone and send pull requests!
Thanks to Caprine for DOM-wrapped-in-Electron app inspiration.
This is a third-party application and is not affiliated with Facebook.
FAQs
Hacky solution for receiving messages on personal accounts
We found that messenger-personal-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.