
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
twitch-redis-bridge
Advanced tools
Creates an interface to Twitch chat via Redis pub/sub.
The origins of this package are described here. This is essentially a Twitch chatbot that serves as a middleman between Twitch chat and a Redis server. It is a key part of the larger dacham-nombox system, but could be employed anywhere Twitch/Redis integration is required.
There are a few configuration options that must be specified before the package can operate properly. A sample config file (config_sample.json) is include in the source tree; use this as the basis for your own.
{
"tmi": {
"channels": [
"laddspencer"
],
"username": "phantsbot"
},
"redis": {
"hostname": "localhost",
"port": 6379,
"channel_prefix": "laddspencer"
},
"credsPath": "/path/to/twitch_creds.json"
}
A sample creds file (creds_example.json) is included in the source tree; use this as the basis for your own.
{
"client_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"client_secret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
client_id and client_secret come from the Twitch bot/app registration process here. This package assumes you already have or can obtain these creds. Once you have them, simply plug them into your creds file.
When run from the command-line, the following options are available:
Options:
-c authcode OAuth Authorization Code (only needed for first time setup.)
-F configfile Configuration file path.
Since Redis is a fundamental part of this package, we take advantage of the fact that we can easily write data to, and read data from this server. The items cached in Redis are the Twitch OAuth Access Token and Refresh Token. These are used each time your bot connects to chat (i.e. every time you run this script). The tokens are initially obtained by following the authorization procedure here. Once you grant your bot access, you will receive an Authorization Code; this code is fed to the script on the command-line with the -c option. After a successful connection, the Access and Refresh Tokens will be cached in Redis and automatically refreshed as needed; you should never have to use the -c option after this (unless the tokens are removed from the Redis cache somehow).
Our interface to Twitch is tmi.js. Events from Twitch chat (e.g. "Message", "Cheer", "Subscription", etc) are sent to us via tmi.js. We translate these events into messages that are published on a Redis pub/sub channel. Channel names are of the form:
<channel_prefix>.twitch.<event_name>
Where channel_prefix is defined in the config file, and event_name is one of the events listed in the tmi.js docs. For example, using the config above, the channel names would be:
laddspencer.twitch.action
laddspencer.twitch.anongiftpaidupgrade
laddspencer.twitch.ban
laddspencer.twitch.chat
laddspencer.twitch.cheer
laddspencer.twitch.clearchat
laddspencer.twitch.connected
...
Subscribe to any of these channels with your favorite Redis client.
You might be saying to yourself "how do I get events for new follows?"...the bad news is that Twitch does not provide this over the chat interface, so it's not currently possible with this package. The good news is that Streamlabs does provide this, and we've written a peer module, streamlabs-redis-bridge, that supports follows and donations.
In addition to publishing events, we can also forward Redis messages to chat. We do this by listening on the "chatter" channel and sending any text to the tmi.js say() command.
<channel_prefix>.chatter.say
Where, as above, channel_prefix is defined in the config file. For example, after twitch-redis-bridge is up and running, connect to the same Redis server and publish a message like this:
$ nc localhost 6379
publish laddspencer.chatter.say "Hello, World!"
The message will be forwarded through Redis to twitch-redis-bridge, which will send it through tmi.js to Twitch Chat:
FAQs
Interface to Twitch chat via Redis pub/sub.
The npm package twitch-redis-bridge receives a total of 0 weekly downloads. As such, twitch-redis-bridge popularity was classified as not popular.
We found that twitch-redis-bridge demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.