Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
xero-node-bankfeeds
Advanced tools
Beta version 0.9.x of xero-node-bankfeeds SDK supports oAuth2 authentication with bank feeds API.
Installation This SDK is published as an npm package called xero-node-bankfeeds.
npm install --save xero-node-bankfeeds
Follow these steps to create your Xero app
A "kitchen sync" app is available that demonstrates interacting with "feedconnections" endpoint. Just download the code and configure.
This is a barebones example showing how to authenticate and display the name of the Xero organisation you've connected to.
Start with an empty folder
npm init
npm install --save xero-node-bankfeeds
npm install express --save
npm install express-session --save
Create your index.js using the code below - don't forget to add your client id and secret
'use strict';
const express = require('express');
const session = require('express-session');
const xero_node_bankfeeds = require('xero-node-bankfeeds');
const client_id = 'YOUR-CLIENT_ID'
const client_secret = 'YOUR-CLIENT_SECRET'
const redirectUri = 'http://localhost:5000/callback'
const scopes = 'openid profile email bankfeeds offline_access'
const xeroClient = new xero_node_bankfeeds.XeroBankFeedClient({
clientId: client_id,
clientSecret: client_secret,
redirectUris: [redirectUri],
scopes: scopes.split(" "),
});
let app = express()
app.set('port', (process.env.PORT || 3000))
app.use(express.static(__dirname + '/public'))
app.use(session({
secret: 'something crazy',
resave: false,
saveUninitialized: true,
cookie: { secure: false }
}));
app.get('/', function(req, res) {
res.send('<a href="/connect">Connect to Xero</a>');
})
app.get('/connect', async function(req, res) {
try {
let consentUrl = await xeroClient.buildConsentUrl();
res.redirect(consentUrl);
} catch (err) {
res.send("Sorry, something went wrong");
}
})
app.get('/callback', async function(req, res) {
const url = "http://localhost:5000/" + req.originalUrl;
await xeroClient.setAccessTokenFromRedirectUri(url);
// Optional: read user info from the id token
let tokenClaims = await xeroClient.readIdTokenClaims();
const accessToken = await xeroClient.readTokenSet();
req.session.tokenClaims = tokenClaims;
req.session.accessToken = accessToken;
res.redirect('/feedconnections');
})
app.get('/feedconnections', async function(req, res) {
try {
const accessToken = req.session.accessToken;
await xeroClient.setTokenSet(accessToken);
// CREATE
var feedConnection = new xero_node_bankfeeds.FeedConnection();
feedConnection.accountName = "SDK Test Account";
feedConnection.accountNumber = "123321";
feedConnection.accountToken = "foobar321";
feedConnection.accountType = xero_node_bankfeeds.FeedConnection.AccountTypeEnum.BANK;
feedConnection.currency = xero_node_bankfeeds.CurrencyCode.GBP;
const feedConnections = new xero_node_bankfeeds.FeedConnections();
feedConnections.items = [feedConnection];
const response = await xeroClient.bankFeedsApi.createFeedConnections(xeroClient.tenantIds[0], feedConnections);
res.send("Bank account create with ID: " + response.body.items[0].id );
} catch (err) {
console.log(err.body);
res.send("Sorry, something went wrong");
}
})
const PORT = process.env.PORT || 5000;
app.listen(PORT, function() {
console.log("Your Xero basic public app is running at localhost:" + PORT)
})
src/
|- gen/ autogenerated TypeScript
`- *.ts handwritten TypeScript
dist/ compiled JavaScript
package.json
FAQs
NodeJS client for Xero bank feeds API with OAuth 2.0 support
We found that xero-node-bankfeeds demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.