Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A Node.js Shopify helper library
To install via npm:
npm install shopify
All API usage happens through Shopify applications, created by either shop owners for their own shops, or by Shopify Partners for use by other shop owners:
For more information and detailed documentation about the API visit http://api.shopify.com
First create a new application in either the partners admin or
your store admin and write down your API_KEY
and SHARED_SECRET
.
You will need to supply two parameters to the Session class before you instantiate it:
var express = require('sys')
, shopify = require('shopify');
var session = new shopify.Session(
API_KEY
, SHARED_SECRET
);
For application to access a shop via the API, they first need a "token" specific to the shop, which is obtained from Shopify after the owner has granted the application access to the shop. This can be done by redirecting the shop owner to permission URL obtained as follows:
var permission_url = session.createPermissionURL(req.query['shop']);
After visiting this URL, the shop redirects the owner to a custom
URL of your application where the token
gets sent to (it's param
name is just t
) along with other parameters to ensure it was sent
by Shopify. That token is used to instantiate the session so that it
is ready to make calls to that particular shop.
session.auth(req.query['shop'], req.query['t'], req.query);
req.session.shopify = {url: session.url, token: session.token}; // save token both URL and token with the session middleware
Now you can finally get the fully authorized URL for that shop. Use that URL to make request to the ShopifyAPI:
var site_url = shopify.site();
To get data from that shop you might consider one of the following libraries:
FAQs
A CLI tool to build for the Shopify platform
The npm package shopify receives a total of 1,061 weekly downloads. As such, shopify popularity was classified as popular.
We found that shopify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.