
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
wechat-payment-sdk
Advanced tools
var Payment = require('wechat-pay').Payment;
var initConfig = {
partnerKey: "<partnerkey>",
appId: "<appid>",
mchId: "<mchid>",
notifyUrl: "<notifyurl>",
pfx: fs.readFileSync("<location-of-your-apiclient-cert.p12>")
};
var payment = new Payment(initConfig);
var order = {
body: '吮指原味鸡 * 1',
attach: '{"部位":"三角"}',
out_trade_no: 'kfc' + (+new Date),
total_fee: 10 * 100,
spbill_create_ip: req.ip,
openid: req.user.openid,
auth_code: '130753555491404466'
};
payment.getBarCodeWCPayRequestParams(order, function(err, payargs){
res.json(payargs);
});
var order = {
body: '吮指原味鸡 * 1',
attach: '{"部位":"三角"}',
out_trade_no: 'kfc' + (+new Date),
total_fee: 10 * 100,
spbill_create_ip: req.ip,
openid: req.user.openid,
trade_type: 'JSAPI'
};
payment.getBrandWCPayRequestParams(order, function(err, payargs){
res.json(payargs);
});
注:
支付授权目录下前端通过
WeixinJSBridge.invoke('getBrandWCPayRequest', payargs, function(res){
if(res.err_msg == "get_brand_wcpay_request:ok"){
alert("支付成功");
// 这里可以跳转到订单完成页面向用户展示
}else{
alert("支付失败,请重试");
}
});
来呼出微信的支付界面
var middleware = require('wechat-pay').middleware;
app.use('<notifyUrl>', middleware(initConfig).getNotify().done(function(message, req, res, next) {
var openid = message.openid;
var order_id = message.out_trade_no;
var attach = {};
try{
attach = JSON.parse(message.attach);
}catch(e){}
/**
* 查询订单,在自己系统里把订单标为已处理
* 如果订单之前已经处理过了直接返回成功
*/
res.reply('success');
/**
* 有错误返回错误,不然微信会在一段时间里以一定频次请求你
* res.reply(new Error('...'))
*/
}));
payment.refund({
out_trade_no: "kfc001",
out_refund_no: 'kfc001_refund',
total_fee: 10 * 100,
refund_fee: 10 * 100
}, function(err, result){
/**
* 微信收到正确的请求后会给用户退款提醒
* 这里一般不用处理,有需要的话有err的时候记录一下以便排查
*/
});
payment.downloadBill({
bill_date: "20140913",
bill_type: "ALL"
}, function(err, data){
// 账单列表
var list = data.list;
// 账单统计信息
var stat = data.stat;
});
在回调的Error上的以name做了区分,有需要可以拿来做判断
FAQs
wechat payment api for document v3.3.5
The npm package wechat-payment-sdk receives a total of 7 weekly downloads. As such, wechat-payment-sdk popularity was classified as not popular.
We found that wechat-payment-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.