
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
根据个人需求不定时不定量更新。欢迎提 Issues。
目前 License 为 GPL,个人用途可闭源,若有需求或者商用请联系我,之后版本会修改 License。
实现例子:

举例应用:
<> 括起来是用户自己补充的值,只需修改这三个参数(和 http 传值)即可使用。
weToken:在 API 接收消息页面填写的 Token
weEncodingAESKey:在 API 接收消息页面填写的 EncodingAESKey
weReceiveId:在“我的企业”页面最下面的“企业 ID”
const { WXBizMsgCrypt } = require('wecom-api')
verifyURL (ctx) {
const { msg_signature, timestamp, nonce, echostr } = ctx.request.query
try {
const wXBizMsgCrypt = new WXBizMsgCrypt(<weToken>, <weEncodingAESKey>, <weReceiveId>)
ctx.body = wXBizMsgCrypt.verifyURL(msg_signature, timestamp, nonce, echostr).message
} catch (e) {
ctx.body = e
}
}
async receiveMsg (ctx) {
const { msg_signature, timestamp, nonce } = ctx.request.query
const postData = ctx.request.body // 注意程序可以接收 xml 格式数据
try {
const wXBizMsgCrypt = new WXBizMsgCrypt(<weToken>, <weEncodingAESKey>, <weReceiveId>)
const receivedmsg = wXBizMsgCrypt.decryptMsg(msg_signature, timestamp, nonce, postData)
const { ToUserName, FromUserName, CreateTime, MsgType, Content, MsgId, AgentID } = receivedmsg
// 示例回复,之后补充 message 格式引用
const xmlText = `<xml><ToUserName><![CDATA[${FromUserName}]]></ToUserName><FromUserName><![CDATA[${ToUserName}]]></FromUserName><CreateTime>${CreateTime}</CreateTime><MsgType><![CDATA[text]]></MsgType><Content><![CDATA[${new Date(Date.now())} ${Date.now().toString()}: ${Content}]]></Content></xml>`
const msg = wXBizMsgCrypt.encryptMsg(xmlText)
ctx.body = msg
} catch (e) {
ctx.body = e
}
}
FAQs
企业微信 API,加解密库 WXBizMsgCrypt,消息推送
The npm package wecom-api receives a total of 1 weekly downloads. As such, wecom-api popularity was classified as not popular.
We found that wecom-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.