
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Node.js library for OWOP. Support Discord server - discord.gg/k4u7ddk.
Installing: npm i owop-js.
REQUIRES NODE.JS 12.0+!
You can also use browser version in OPM. In OPM version there is simpleChunks option for using OWOP internal chunks, renderCaptcha for captcha rendering, and there is no agent, origin, controller, and other node.js only options.
const OJS = OPM.require("owop-js");
const Client = new OJS.Client({
reconnect: true
});
Client.on("join", () => {
Client.chat.send("Hello from browser OJS!");
});
const OJS = require("owop-js");
const Client = new OJS.Client({
reconnect: true,
controller: true
});
Client.on("join", () => {
Client.chat.send("Hello, OWOP from OJS!");
});
open - Opened WebSocket connection.
close - Closed WebSocket connection.
join - Joined to world [world name].
id - Got id [id].
rawMessage - Any message from WebSocket server. (It can be object or string) [data].
update - Player in world updates [player object].
pixel - New pixel in world [x, y, [r, g, b]].
disconnect - Someone in world disconnected [player object].
connect - Someone in world connected [id].
teleport - got 'teleport' opcode. Very rare. [x, y].
rank - Got new rank. [rank].
captcha - Captcha state. [gcaptcha id].
chunkProtect - Chunk (un)protected. [x, y, newState].
pquota - New PQuota. [rate, per].
destroy - Socket was destroyed and won't reconnect anymore.
chunk - New chunk. [x, y, chunk, protected].
message - New message in chat. [msg].
ws - Websocket server address. (default - wss://ourworldofpixels.com)
origin - Origin header (default - https://ourworldofpixels.com).
id - ID for logging. If not set, OWOP ID will be used.
agent - Proxy Agent.
world - World name. (default - main).
noLog - No logging.
reconnect - Reconnect if disconnected.
adminlogin - Admin login.
modlogin - Mod login.
pass - Pass for world.
captchapass - Captcha pass.
teleport - Teleport on 'teleport' opcode.
controller - Enable controller for this bot. (Use only once!).
reconnectTime - Reconnect time (ms) after disconnect (default - 5000).
unsafe - Use methods that are supposed to be only for admin or moderator.
When you require lib, you get object with:
Client - main OJS Client class (requires options object).
Bucket - Bucket class for quota.
ChunkSystem - Class for chunks, pixels management.
Chunks - instance of ChunkSystem, all bots that will request chunks will give chunk info to this instance.
Client API is similar to OWOP, and some methods have same 'path'.
Object with all ranks - ADMIN, MODERATOR, USER and NONE.
Object with OWOP options. Check code to see them.
Options that you passed in options argument.
Send message in chat.
Local message in console.
Function for modifying and getting messages that you gonna send.
Function for modifying and getting messages that you're getting from server.
All messages that you got. Keep in mind that it can only hold maximum of Client.options.maxChatBuffer messages in it (default - 256).
Function to join world. Should not be used, only for internal use! For connections to new worlds you should use new Client with world option in it.
Leave world. If there's reconnect option enabled, client will try to reconnect after options.reconnectTime (default - 5000ms) seconds.
Leave world and don't reconnect anymore.
Move bot to X, Y.
Move and set pixel. If sneaky option is set to true, bot will return to old location.
Set tool that bot has eqquiped.
Set color of bot.
Protect chunk. You need to be admin to use this but you can ignore this if you'll use unsafe option.
Clear chunk. You need to be admin to use this but you can ignore this if you'll use unsafe option.
Request chunk, it'll be loaded to ChunkSystem. If inaccurate argument is passed, it'll transform x and y to chunkX and chunkY, so you can use normal coords to request chunks. Returns raw chunk.
if(inaccurate) {
x = Math.floor(x/OJS.options.chunkSize);
y = Math.floor(y/OJS.options.chunkSize);
};
Request chunk and get pixel.
List of players. Every player is object with properties:
Example: Client.players[15035].
Client destroyed.Bucket for PQuota.Client.player.id or option.id if option.noLog is enabled.Client also has primitive EventEmitter - on, once, emit, off.
This class is created just for Chunks, I don't think you'll ever need to use it.
All chunks and pixels stuff goes here.
Chunks.chunks[x][y].chunks but only for protected chunks.Keep in mind, that you'll usually only need Chunks.getPixel from all this stuff here.
Set chunk data.
Get chunk data. Usually it tries to get chunks by normal coords, but if you'll set raw arg, you can use your own chunk coords.
Remove chunk.
Set pixel in chunk.
Get pixel from chunk.
Protect chunk.
Unprotect chunk.
Is chunk protected.
License - MIT.
Created by dimden.
FAQs
The OWOP (ourworldofpixels) API.
The npm package owop-js receives a total of 1 weekly downloads. As such, owop-js popularity was classified as not popular.
We found that owop-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.