
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
slack-karma-bot
Advanced tools
A lean no-database Slack bot app that allows a user to give karma points to other users.
The bot can process karma commands in any public or private channel that it's added to.
All the karma scores for the users in the Slack workspace is stored in a Slack message.
It's recommended that you create a private channel in your Slack workspace to store the karma scores and only add the karma bot and admins of the karma bot to the channel.
Create a node app that initializes the Slack Karma Bot app like such.
import { App } from "slack-karma-bot"
const app = new App({
token: process.env.SLACK_BOT_TOKEN,
signingSecret: process.env.SLACK_SIGNING_SECRET,
scoreMapStoreChannelId: process.env.SCORE_MAP_STORE_CHANNEL_ID,
scoreMapStoreMessageTs: process.env.SCORE_MAP_STORE_MESSAGE_TS
})
You need both the token
and signingSecret
before the bot can do anything.
What the environmental variables mean:
SLACK_BOT_TOKEN
is the bot token you can retrieve from the OAuth & Permissions tab https://api.slack.com/apps/{APP_ID}
/oauthSLACK_SIGNING_SECRET
is the signing secret that allows the Karma Bot App to verify that incoming requests are coming from Slack. You can retrieve from the App Credentials section of https://api.slack.com/apps/{APP_ID}
SCORE_MAP_STORE_CHANNEL_ID
is the private channel where you are storing the karma scores. To get the channel id, right click the channel and select "View channel details".SCORE_MAP_STORE_MESSAGE_TS
is the ts
value of the message where the karma score map is stored. The ts
value is essentially the ID of the message. To get the ts
value, add the karma bot to the channel, then mention it with "init" message. The karma bot will initialize the empty score object in a new message, then provide the ts
value of the first new message in a second new message.The bot app wraps bolt so calling the start
method will call the start
method in bolt.
(async () => {
const port = Number(process.env.PORT) || 3000
console.log(`Starting app on port ${port}`)
await app.start(port)
console.log("⚡️ Bolt app is running!")
})()
After you have started the bot, you need to use the bot to initialize the datastore where you want the karma points to be kept. This is a one-time setup.
Invite the karma bot to the private channel.
Initialize the data store
Option 1: initialize with empty data:
@<bot_name> init
Option 2: initialize with existing data:
@<bot_name> init <existing_data>
existing_data
will be a stringified JSON object that contains the karma score map. The format of the JSON object is:
{ "<user_id_1>": 1, "<user_id_2>": 1, "<user_id_3>": 10 }
Retrieve the ts
value posted by the bot.
Add the ts
value to the SCORE_MAP_STORE_MESSAGE_TS
environment variable and restart your app.
@<user_name> ++
You can add any text after the ++
to give context for why you are giving the karma point.
@<bot_name> init
@<bot_name> init { "<user_id_1>": 1, "<user_id_2>": 1, "<user_id_3>": 10 }
You can try out the Slack Karma Bot app in development mode by running the following command which spins up the node server in example/index.ts
Clone the repo, then install all the dependencies.
nvm use
yarn
yarn dev
HMR is supported but every time you make a change to the .env
file, you will need to restart the server for the change to take effect.
The Slack app server start on localhost:3000. You can use ngrok to proxy your local server to the internet via a public URL.
brew install ngrok/ngrok/ngrok
ngrok http 3000
After running the command, the ngrok console will display the public URL that Slack can use to access your local server. Go to https://api.slack.com/apps/{APP_ID}
/event-subscriptions and make the Request URL {ngrok-url}/slack/events
FAQs
Slack bot for giving kudos
We found that slack-karma-bot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.