Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
nodejs-wechat
Advanced tools
Nodejs wrapper of wechat api
var http = require('http');
var xmlBodyParser = require('express-xml-parser');
var Wechat = require('nodejs-wechat');
var opt = {
token: 'TOKEN',
url: '/'
};
var parse = xmlBodyParser({
type: 'text/xml'
});
var wechat = new Wechat(opt);
wechat.on('event.subscribe', function(session) {
session.replyTextMsg('欢迎您关注我们的订阅号');
});
var server = http.createServer(function(req, res) {
if (req.method === 'GET') {
wechat.verifyRequest(req, res);
} else {
parse(req, res, function(err) {
if (err) {
res.end();
return;
}
wechat.handleRequest(req, res);
});
}
});
server.listen(80);
var express = require('express');
var app = express();
var middlewares = require('express-middlewares-js');
app.use('/weixin', middlewares.xmlBodyParser({
type: 'text/xml'
}));
/*
Alternative way
var xmlBodyParser = require('express-xml-parser');
app.use('/weixin', xmlBodyParser({
type: 'text/xml',
limit: '1mb'
}));
*/
var Wechat = require('nodejs-wechat');
var opt = {
token: token,
url: '/weixin'
};
var wechat = new Wechat(opt);
app.get('/weixin', wechat.verifyRequest.bind(wechat));
app.post('/weixin', wechat.handleRequest.bind(wechat));
// you can also work with other restful routes
app.use('/api', middlewares.bodyParser());
wechat.on('text', function(session) {
session.replyTextMsg('Hello World');
});
wechat.on('image', function(session) {
session.replyNewsMsg([{
Title: '新鲜事',
Description: '点击查看今天的新鲜事',
PicUrl: 'http://..',
Url: 'http://..'
}]);
});
wechat.on('voice', function(session) {
session.replyMsg({
Title: 'This is Music',
MsgType: 'music',
Description: 'Listen to this music and guess ths singer',
MusicUrl: 'http://..',
HQMusicUrl: 'http://..',
ThumbMediaId: '..'
});
});
app.listen(80);
NOTE: We apply
{ type: 'text/xml' }
toxmlBodyParser
as weixin server send us atext/xml
content type instead ofapplication/xml
.
#verifyRequest(req, res)
This is a express/connect middleware, which verify the signature of request from weixin server
#handleRequest(req, res)
This is a express/connect middleware, which handle the request post from weixin server
#on(msgType, handler)
Wechat is an inheritance from event.EventEmitter. Wechat will emit an event in incoming message's
MsgType
, with aSession
as parameter. Valid events:
text
,image
,voice
,video
,location
,link
,event.subscribe
,event.unsubscribe
,event.SCAN
,event.LOCATION
,event.CLICK
,event.VIEW
,error
incomingMessage
This is a direct parse of weixin server request
<xml>
<ToUserName><![CDATA[toUser]]></ToUserName>
<FromUserName><![CDATA[FromUser]]></FromUserName>
<CreateTime>123456789</CreateTime>
<MsgType><![CDATA[event]]></MsgType>
<Event><![CDATA[subscribe]]></Event>
</xml>
Becomes
{
"ToUserName": "toUser",
"FromUserName": "FromUser",
"CreateTime": "123456789",
"MsgType": "event",
"Event": "subscribe"
}
req
This is the request from weixin server
res
This is the response to weixin server
#replyMsg(msgObject)
Reply a message via
this.res
#replyTextMessage(content)
Reply a text message
#replyNewsMessage(articles)
Reply a news messages.
Will finish advanced interfaces before July/2014, welcome send pull requests :)
FAQs
nodejs wrapper of wechat(weixin) api - well tested and bug-free
The npm package nodejs-wechat receives a total of 1 weekly downloads. As such, nodejs-wechat popularity was classified as not popular.
We found that nodejs-wechat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.