
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
unoapi-cloud
Advanced tools
An implementation of Baileys(https://github.com/adiwajshing/Baileys
) as
RESTful API service with multi device support with a Whatsapp Cloud API format
https://developers.facebook.com/docs/whatsapp/cloud-api
.
The media files are saved in file system at folder data with the session.
The payload is based on
https://developers.facebook.com/docs/whatsapp/cloud-api/webhooks/components#messages-object
To send a message
curl -i -X POST \
http://localhost:9876/v15.0/5549988290955/messages \
-H 'Content-Type: application/json' \
-d '{
"messaging_product": "whatsapp",
"to": "5549988290955",
"type": "text",
"text": {
"body": "hello"
}
}'
To send a message to group
curl -i -X POST \
http://localhost:9876/v15.0/5549988290955/messages \
-H 'Content-Type: application/json' \
-d '{
"messaging_product": "whatsapp",
"to": "120363040468224422@g.us",
"type": "text",
"text": {
"body": "hello"
}
}'
To test media
curl -i -X GET \
http://localhost:9876/v15.0/5549988290955/3EB005A626251D50D4E4 \
-H 'Content-Type: application/json'
This return de url and request this url like
curl -i -X GET \
http://locahost:9876/download/v13/5549988290955/5549988290955@s.whatsapp.net/48e6bcd09a9111eda528c117789f8b62.png \
-H 'Content-Type: application/json'
To send media
https://developers.facebook.com/docs/whatsapp/cloud-api/guides/send-messages#media-messages
curl -i -X POST \
http://localhost:9876/v15.0/5549988290955/messages \
-H 'Content-Type: application/json' \
-d '{
"messaging_product": "whatsapp",
"to": "5549988290955",
"type": "image",
"image": {
"link" : "https://github.githubassets.com/favicons/favicon-dark.png"
}
}'
Webhook Events like this https://developers.facebook.com/docs/whatsapp/cloud-api/webhooks/payload-examples
Message status update on this https://developers.facebook.com/docs/whatsapp/cloud-api/webhooks/payload-examples#message-status-updates
To turn possible work with group, we add two fields(group_id, group_subject) in
message beside cloud api format if IGNORE_GROUP_MESSAGES
is false
.
{
"object": "whatsapp_business_account",
"entry": [{
"id": "WHATSAPP_BUSINESS_ACCOUNT_ID",
"changes": [{
"value": {
"messaging_product": "whatsapp",
"metadata": {
"display_phone_number": PHONE_NUMBER,
"phone_number_id": PHONE_NUMBER_ID
},
"contacts": [{
"profile": {
"name": "NAME"
},
"group_id": "123345@g.us",
"group_subject": "Awesome Group",
"wa_id": PHONE_NUMBER
}],
"messages": [{
"from": PHONE_NUMBER,
"id": "wamid.ID",
"timestamp": TIMESTAMP,
"text": {
"body": "MESSAGE_BODY"
},
"type": "text"
}]
},
"field": "messages"
}]
}]
}
Messages failed with this
https://developers.facebook.com/docs/whatsapp/cloud-api/webhooks/payload-examples#status--message-failed
Custom errors sound append this codes
https://developers.facebook.com/docs/whatsapp/cloud-api/support/error-codes
with:
Copy .env.example to .env an set your config
A docker-compose.yml
file is available:
docker compose up
Visit http://localhost:9876/ping
wil be render a "pong!"
A docker-compose.yml
example for production:
version: '3'
services:
app:
image: clairton/unoapi-cloud:latest
volumes:
- ./data:/home/u/app/data
deploy:
restart_policy:
condition: on-failure
Visit http://localhost:9876/ping
wil be render a "pong!"
The ENV Configurations put default value and the format and same name of configs:
WEBHOOK_URL=the webhook url
WEBHOOK_TOKEN=the webhook header token
WEBHOOK_HEADER=the webhook header name
BASE_URL=current base url to download medias
PORT=the http port
IGNORE_GROUP_MESSAGES=false to send group messages received in socket to webhook, default true
IGNORE_BROADCAST_STATUSES=false to send stories in socket to webhook, default true
IGNORE_BROADCAST_MESSAGES=false to send broadcast messages in socket to webhook, default false
IGNORE_OWN_MESSAGES=false to send own messages in socket to webhook, default true
I can't guarantee or can be held responsible if you get blocked or banned by using this software. WhatsApp does not allow bots using unofficial methods on their platform, so this shouldn't be considered totally safe.
Released under the GPLv3 License.
Comercial version is available:
More informations in http://wa.me/+5549988290955
FAQs
Unoapi Cloud
The npm package unoapi-cloud receives a total of 8 weekly downloads. As such, unoapi-cloud popularity was classified as not popular.
We found that unoapi-cloud demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.