
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
_ __ __ _
| | / _|/ _| |
| |___ ____ _| |_| |_| | ___
| __\ \ /\ / / _' | _| _| |/ _ \
| |_ \ V V / (_| | | | | | | __/
\__| \_/\_/ \__,_|_| |_| |_|\___|
A TWitter rAFFLE script.
Twaffle allows you to extract random tweets for a set of keywords. It's ideal to do raffles over tweeter: get some people to tweet some specific keywords and then extract an arbitrary number of random winners!
npm install --global twaffle
Or you can use it with npx (see usage), so in such case you don't have to install it at all.
Finally, you can also use the compiled binaries distributed for the major operative systems.
To use Twaffle you would need to access to the Twitter developer platform and have obtained keys for an app.
Once you got your keys, make sure that they are exported as environment variables in the local shell:
export TWITTER_CONSUMER_KEY="..."
export TWITTER_CONSUMER_SECRET="..."
export TWITTER_ACCESS_TOKEN_KEY="..."
export TWITTER_ACCESS_TOKEN_SECRET="..."
Note: Twitter keys can also be passed as arguments, see twaffle --help for more details.
At this point you can run twaffle as in the following example:
twaffle --keywords '#oredev again' --winners=3
this will extract 3 random tweets that have the keywords #oredev and again.
If you didn't install twaffle and you have a recent version of NPM you can simply run twaffle through npx:
npx twaffle --keywords '#oredev again' --winners=3
If you find a bug or have an idea about how to improve Twaffle you can open an issue or submit a pull request, it will definitely make you a better person! 😇
Licensed under MIT License. © Luciano Mammino.
FAQs
A TWitter rAFFLE script
We found that twaffle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.