
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
pw-js-world
Advanced tools
This is a helper for the main library PW-JS-Api (since v0.2.1).
To install this dependency, you must install PW-JS-Api first before installing this helper.
NPM:
npm i pw-js-api pw-js-world
PNPM:
pnpm i pw-js-api pw-js-world
Yarn:
yarn add pw-js-api pw-js-world
Bun:
bun i pw-js-api pw-js-world
The code below shows an example, it does not do anything but you will get an idea on what you're expected to do before being able to use this.
import { BlockNames, PWApiClient } from "pw-js-api";
import { PWGameWorldHelper } from "pw-js-world";
const api = new PWApiClient(<YOUR_EMAIL>, <YOUR_PASSWORD>);
const helper = new PWGameWorldHelper();
await api.authenticate();
const con = await api.joinWorld(<WORLD_ID>, {
gameSettings: {
handlePackets: ["PING", "INIT"]
}
});
con
// This is important, you must add the hook as soon as you get the
// connection before it receives init event.
.addHook(helper.receiveHook)
.addCallback("playerInitPacket", (data, states) => {
console.log("Logged in as " + states?.player?.username);
})
.addCallback("worldBlockPlacedPacket", (data, states) => {
console.log("Prev Block Id: " + states?.oldBlocks[0].bId);
console.log("Prev Block Args: " + states?.oldBlocks[0].args);
console.log("New Block Id: " + states?.newBlocks[0].bId);
console.log("New Block Args: " + states?.newBlocks[0].args);
});
Once you have added the hook, the states (second parameter) in some of the callbacks will have the variables populated, allowing you to get the player object directly without needing to do yourself.
They may be undefined if the events occur before the initialisation of helper (which can happen in the first two seconds since the bot joins).
Alternatively, you can export and use the helper directly yourself if you want.
FAQs
An optional package for PW-JS-Api, aims to serve world purposes.
The npm package pw-js-world receives a total of 5 weekly downloads. As such, pw-js-world popularity was classified as not popular.
We found that pw-js-world demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.