
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
目前支持连连支付、易宝支付、pp钱支付、闪豆支付、宝付支付、汇付托管支付。类似ping++
npm install n-pay
var nPay = require('n-pay');
var PAY = nPay({
appid:'your appid',
appkey:'your appkey',
serverDomain:'http://pay.kaolalicai.cn',
npay_version:'1.0',
npay_sign_type:'RSA',
cryptoConfig:{
'md5_key':'',//md5 key
'des_key':'',//des key,24个字符长度
'aes_key':'',//aes key,16个字符长度
'merchant_pri_key':'',
'npay_pub_key':''
}
})
//appid,appkey请向广州财略金融信息科技有限公司申请
##获取支付内容(html或者url)
PAY.pay(
{
channel:'pay channel ,such as yeepay',
merchant_account:'your pay channel account'
},
{
'order_id':"abc_test",//订单id,长度必须小于等于32位
'user_id':"abc_user",//用户在商户系统中的id
'amount':0.01,//支付金额,元为单位
'trans_time':Date.now(),//交易时间(时间戳)
'reg_time':Date.now(),//用户在商户系统中的注册时间(时间戳)
'return_url':"http://www.kaolalicai.cn",//支付结果跳转页(同步)
'notify_url':"http://www.kaolalicai.cn",//支付结果通知地址(异步),只有支付成功才会像这个地址post数据
'order_desc':"test pay",//订单描述
'idcard':'',
'card_no':'',
'acct_name':'',
'reg_phone':'user register phone'//用户在商户系统中注册的手机号(channel为ppwallet时必传)
},
function(err,data){
if(!err && data.code === 0){
//todo,这里为支付的内容(url或一段html的form表单)
//web段使用例子:
//var data = data.data;
// if(/^http/.test(data)){
// window.location.href = data;
// }else{
// document.getElementsByTagName('body')[0].innerHTML = data;
// document.forms[0].submit();
// }
}else{
//todo,请求失败
}
}
)
需要注意的是,pp钱包目前没有查询订单的接口,当code为-2时,需要去pp钱包后台确认订单最终支付情况。
PAY.query(
{
channel:'pay channel ,such as yeepay',
merchant_account:'your pay channel account'
},
{
'order_id':"abc_test"
},
function(err,data){
if(!err){
if(data.code === 0){
//todo,支付成功,商户可以进行订单更新或者发货了。
}else if(data.code === -2){
//todo,支付成功,但是需要去第三方支付平台确认最终支付情况。
}else{
//todo.支付不成功。
}
}else{
//todo,请求失败
}
}
)
PAY.getPayment(
function(err,data){
if(!err){
if(data.code){
console.log(data.data);//string ,'yeepay,llpay,ppwallet'
}
}
}
)
解密后的数据plaintext:plaintext.pay_result为字符串0表示支付成功
var parseData = PAY.paySuccess(sign,ciphertext,npay_sign_type);
if(parseData.success){
//todo,可以发货了
//订单详细信息,parseData.plaintext
//res.send(PAY.getStopNotifyData())
}
res.send(PAY.getStopNotifyData())
当商户接收回调后,返回一段非空字符串,比如success将会终止回调
## 发布logsnpay_version:2.0
2.0以上版本支持汇付支付,
npay_version传值2.0新增字段pageType(页面类型,pc或者移动),merPriv商户私有域
获取终止异步回调的字符串需传入第三方返回的原始数据,即接口:
getStopNotifyData汇付支付的时候需要传用户在汇付开户的用户客户号,即
third_user_id字段,对应汇付原始字段UsrCustId为适配汇付订单查询,查询接口新增字段queryTransType,充值订单为
SAVE,提现订单为CASH购买接口原路返回第三方支付的回调结果,字段名:origin,数据格式为json字符串(商户需自己调用JSON.parse进行解析).
FAQs
n-pay支付模块
We found that n-pay demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.