Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This document is primarily on Russian, because QIWI Bank (JSC) is Russian bank and mostly russian people interested in this package. Whoever, i added short translations, marked by 🇬🇧 emoji, so you can understand what is going on there.
🇬🇧: Table of Contents
🇬🇧: Why use this lib?
TypeScript
Personal
и P2P
секции QIWI APIVSCode
и WebStorm
🇬🇧: First-class TS support, Personal & P2P api coverage, In-Code docs that's appear in editor
npm i -S qiwi-sdk
yarn add qiwi-sdk
🇬🇧: Getting information about the owner of the wallet
const QIWI = require("qiwi-sdk");
const qp = new QIWI.Personal(process.env.QIWI_TOKEN);
qp.getPersonProfile().then(console.log);
// => { contractInfo: {...}, authInfo: {...}, userInfo: {...} }
🇬🇧: How to steal wallet's balance
⚠️ Если вы делаете это другим людям без их согласия - это противозаконно, я оставляю это тут, потому что это хороший пример комплексного использования API
🇬🇧: If you do this to other people without their consent, it is illegal, I leave it here because it is a good example of complex API use.
const QIWI = require("qiwi-sdk");
const qp = new QIWI.Personal(process.env.QIWI_TOKEN);
const receiver = "+79123456789";
const provider = 99;
async function main() {
const profile = await qp.getPersonProfile();
const wallet = profile.authInfo.personId.toString();
const accounts = await qp.getAccounts(wallet);
const rubleAccount = accounts.find(
(accumulator) =>
accumulator.balance &&
accumulator.balance.currency === Personal.Currency.RUB
);
const commission = await qp.getCommission(
provider,
receiver,
rubleAccount.balance.amount
);
const totalToSteal = rubleAccount.balance.amount - commission;
const payment = await qp.pay(provider, receiver, totalToSteal);
console.log(payment);
}
main();
🇬🇧: Creating key pair for P2P API
const QIWI = require("qiwi-sdk");
const qp = new QIWI.Personal(process.env.QIWI_TOKEN);
async function main() {
const profile = await qp.getPersonProfile();
const wallet = profile.authInfo.personId;
const [pk, sk] = await qp.createP2PKeyPair("My super pair name");
// Да, они инвертированы в порядке,
// так как PublicKey не всегда нужен
const p2pc = new QIWI.P2P(sk, pk);
const bill = await p2pc.createBill({
amount: {
value: 1000,
currency: QIWI.P2P.Currency.RUB
},
expirationDateTime: QIWI.P2P.formatLifetime(2 /* 2 дня */),
comment: "Создание сайта"
});
console.log(bill.payUrl);
}
main();
🇬🇧: Getting wallet's limits (on TypeScript)
import { Personal } from "qiwi-sdk";
const qp = new Personal(process.env.QIWI_TOKEN);
async function main() {
const { limits } = await qp.getLimits(process.env.QIWI_WALLET as string, [
Personal.LimitType.TURNOVER
]);
const [limit] = limits.RU;
console.log(limit);
// => { type: "TURNOVER", currency: "RUB", max: 400000, spent: 0, rest: 400000, ... }
}
У нас есть точно такое-же типизированное SDK для YooMoney 👉 github.com/AlexXanderGrib/yoomoney-sdk
🇬🇧: Have interest in well-done SDK for YooMoney (formerly Yandex.Money)? Check out my other lib
FAQs
⭐ QIWI SDK for node: P2P Payments & Wallet management
The npm package qiwi-sdk receives a total of 1,300 weekly downloads. As such, qiwi-sdk popularity was classified as popular.
We found that qiwi-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.