
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
A Node.js module for using PushJet API.
npm i pushjet
All methods described in PushJet documentation are supported.
Each method returns Promise which fulfilled with appropriate json object or rejected with an error.
Send a message
name | type | meaning | example | required |
---|---|---|---|---|
secret | string | the service secret token | d2d1820d56b862a6f5b1a69a7af730fa | X |
message | string | The notification text | our server is on fire!!@#! | X |
title | string | A custom message title | Big server #5 | |
level | integer | The importance level from 1(low) to 5(high) | 3 | |
link | string | http://i.imgur.com/TerUkQY.gif | An optional link |
Fetch unread messages
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
Mark messages as read
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
Create service
name | type | meaning | example | required |
---|---|---|---|---|
name | string | The service name | important stuff | X |
icon | string | The service icon | http://im.gy/images/SkZ.png |
Get service info
name | type | meaning | example | required |
---|---|---|---|---|
service | string | Obtain service info using the public token | 4be3-eda97a-0d7faeab05a0-89403-ad4751c49 | |
secret | string | Obtain service info using the secret | d2d1820d56b862a6f5b1a69a7af730fa |
Update service info
name | type | meaning | example | required |
---|---|---|---|---|
secret | string | The service secret | stringd2d1820d56b862a6f5b1a69a7af730fa | X |
name | string | Updated service name | Cool new name | |
icon | string | Updated service image | http://im.gy/images/SkZ.png |
This will unsubscribe all listeners
name | type | meaning | example | required |
---|---|---|---|---|
secret | string | The service secret | d2d1820d56b862a6f5b1a69a7af730fa | X |
Subscribe to a service
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
service | string | The service's public token | 4be3-eda97a-0d7faeab05a0-89403-ad4751c49 | X |
Get subscriptions
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
Unsubscribe
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
service | string | The service's public token | 4be3-eda97a-0d7faeab05a0-89403-ad4751c49 | X |
Registering a device for GCM
Only enabled when Google Cloud Messaging is enabled on the server
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
regid | string | The registration ID generated by GCM | EXAMPLExV2lcV2zEKTLNYs625zfk2jh4EXAMPLE | X |
pubkey | string | Optional public key for message encryption |
Removing a GCM registration
name | type | meaning | example | required |
---|---|---|---|---|
uuid | string | The device UUID | D867AB3E-36D2-11E4-AEA8-76C9E2E253B6 | X |
We share service's public token between pusher and receiver.
'use strict';
const PushJet = require('pushjet');
const pusher = new PushJet('https://api.pushjet.io/');
const name = 'pizza';
const icon = 'https://ipfs.pics/ipfs/QmVBjUHLS4jewV1VVwDRBfB2DBjqYA993jjUBVez2God21';
// subscribe to a service and receive messages
const subscribe = (pusher, service) => {
const uuid = require('node-uuid');
const device = uuid.v4();
pusher.subscribeToService(device, service).then((subsciption) => {
console.log('device', device, 'subscribed');
const WebSocket = require('ws');
const ws = new WebSocket('wss://api.pushjet.io/ws');
ws.on('open', () => {
console.log('connector connected');
ws.send(device, (error) => {
console.log('sending', device, error ? error : 'ok');
});
});
ws.on('message', (data, flags) => {
console.log(data);
if (JSON.parse(data).subscription) {
console.log('connection closed');
ws.close();
}
});
}).catch((error) => {
console.log('cannot subscribe', error);
});
};
// create service, tell about eating pizzas, and then delete service
pusher.createService(name, icon).then((service) => {
const pizzas = 4;
let n = 0;
const push = () => {
pusher.sendMessage(service.secret, `eat pizza #${++n}`, 'yum-yum')
.then((status) => {
console.log('message', n, 'sent', status);
if (n < pizzas) {
// schedule next message
setTimeout(push, 1000);
return;
}
// there are no more pizzas
pusher.deleteService(service.secret).then((status) => {
console.log('service deleted');
}).catch((error) => {
console.log('cannot delete service', error);
});
}).catch((error) => {
console.log('error', error);
});
};
// subscribe to a service
subscribe(pusher, service.public);
// start sending
push();
}).catch((error) => {
console.log('error', error);
});
MIT
FAQs
Node.js PushJet API support
The npm package pushjet receives a total of 2 weekly downloads. As such, pushjet popularity was classified as not popular.
We found that pushjet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.