Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
wechatpay-nodesdk
Advanced tools
微信支付 SDK,支持刷卡支付、公众号支付、扫码支付、APP 支付、H5 支付,以及优惠券,红包,企业付款,微信代扣
##Fork版本
此版本是fork版本,在实际生产应用的时候发现了许多BUG,此项目为原有项目的部分bug修复版本。
const path = require("path");
const fs = require("fs");
const {
PubPay,
RequestError,
CommunicationError,
utils: { getXMLBody }
} = require("@sigodenjs/wechatpay");
const pay = new PubPay({
appId: "wxb80e5bddb2d804f3",
key: "6Q9VX4N3WTBM9G9XBL7H1L9PB9ANHLY7",
mchId: "1434712502",
pfx: fs.readFileSync(path.resolve(__dirname, "cert.p12"))
});
// 调用统一下单接口
pay
.unifiedOrder({
body: "腾讯充值中心-QQ会员充值",
out_trade_no: "1217752501201407033233368018",
total_fee: 888,
spbill_create_ip: "8.8.8.8",
notify_url: "https://example.com/wechatpay/notify",
trade_type: "JSAPI",
openid: "oUpF8uMuAJO_M2pxb1Q9zNjWeS6o"
})
.then(res => {
if (!pay.verifySign(res)) {
// 签名校验失败
throw new Error("签名校验失败");
}
if (res.result_code === "FAIL") {
console.log(res.err_code, res.err_code_des);
} else {
console.log(res.prepay_id);
}
})
.catch(err => {
if (err instanceof RequestError) {
// 请求错误
} else if (err instanceof CommunicationError) {
// return_code = FAIL
}
});
// 支付结果通知
router.post("/wechatpay/notify", (req, res) => {
const options = {
length: req.headers["content-length"],
limit: "1mb",
encoding: "utf8"
};
getXMLBody(req, options).then(data => {
pay
.payNotify(data, async parsedData => {
if (!pay.verifySign(parsedData)) {
// 签名校验失败
}
if (parsedData.result_code === "FAIL") {
// 业务逻辑失败
}
// ...
return {
return_code: "SUCCESS",
return_msg: "OK"
};
})
.then(returnData => {
res.set("Content-Type", "application/xml; charset=utf-8");
res.end(returnData);
});
});
});
如果你只使用了某一项支付,请使用业务类。但如果涉及多种支付,使用综合类更便捷。
Copyright (c) 2018 sigoden
Licensed under the MIT license.
FAQs
微信支付 SDK,支持刷卡支付、公众号支付、扫码支付、APP支付、H5支付,以及优惠券,红包,企业付款,微信代扣
The npm package wechatpay-nodesdk receives a total of 7 weekly downloads. As such, wechatpay-nodesdk popularity was classified as not popular.
We found that wechatpay-nodesdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.