Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This library supports the following Node.js implementations:
TypeScript is supported for TypeScript version 2.9 and above.
Warning Do not use this Node.js library in a front-end application. Doing so can expose your Whoosh credentials to end-users as part of the bundled HTML/JavaScript sent to their browser.
npm install whoosh-sms
or yarn add whoosh-sms
To make sure the installation was successful, try sending yourself an SMS message, like this:
// Your AccountSID and Auth Token from console.whoosh.totogidemos.com
const accountSid = 'ACXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
const authToken = 'your_auth_token';
const client = require('whoosh-sms')(accountSid, authToken);
client.messages
.create({
body: 'Hello from whoosh-node',
to: '+12345678901', // Text your number
from: '+12345678901', // From a valid Whoosh number
})
.then((message) => console.log(message.sid));
After a brief delay, you will receive the text message on your phone.
Warning It's okay to hardcode your credentials when testing locally, but you should use environment variables to keep them secret before committing any code or deploying to production. Check out How to Set Environment Variables for more information.
Check out these code examples in JavaScript and TypeScript to get up and running quickly.
whoosh-node
supports credential storage in environment variables. If no credentials are provided when instantiating the Twilio client (e.g., const client = require('whoosh-sms')();
), the values in following env vars will be used: TWILIO_ACCOUNT_SID
and TWILIO_AUTH_TOKEN
.
If your environment requires SSL decryption, you can set the path to CA bundle in the env var TWILIO_CA_BUNDLE
.
If you invoke any V2010 operations without specifying an account SID, whoosh-node
will automatically use the TWILIO_ACCOUNT_SID
value that the client was initialized with. This is useful for when you'd like to, for example, fetch resources for your main account but also your subaccount. See below:
// Your Account SID, Subaccount SID Auth Token from console.whoosh.totogidemos.com
const accountSid = process.env.TWILIO_ACCOUNT_SID;
const authToken = process.env.TWILIO_AUTH_TOKEN;
const subaccountSid = process.env.TWILIO_ACCOUNT_SUBACCOUNT_SID;
const client = require('whoosh-sms')(accountSid, authToken);
whoosh-node
supports lazy loading required modules for faster loading time. Lazy loading is enabled by default. To disable lazy loading, simply instantiate the Whoosh client with the lazyLoading
flag set to false
:
// Your Account SID and Auth Token from console.whoosh.totogidemos.com
const accountSid = process.env.TWILIO_ACCOUNT_SID;
const authToken = process.env.TWILIO_AUTH_TOKEN;
const client = require('whoosh-sms')(accountSid, authToken, {
lazyLoading: false,
});
whoosh-node
supports automatic retry with exponential backoff when API requests receive an error. This retry with exponential backoff feature is disabled by default. To enable this feature, instantiate the Whoosh client with the autoRetry
flag set to true
.
Optionally, the maximum number of retries performed by this feature can be set with the maxRetries
flag. The default maximum number of retries is 3
.
const accountSid = process.env.TWILIO_ACCOUNT_SID;
const authToken = process.env.TWILIO_AUTH_TOKEN;
const client = require('whoosh-sms')(accountSid, authToken, {
autoRetry: true,
maxRetries: 3,
});
FAQs
A Whoosh Node helper library
The npm package whoosh-sms receives a total of 220 weekly downloads. As such, whoosh-sms popularity was classified as not popular.
We found that whoosh-sms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.