
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
xmpp-command-bot
Advanced tools
An XMPP bot which takes messages from a chat room or a prescribed set of users and runs commands on the local server.
Copy config.example.js to config.js and modify as required.
An example XMPP configuration object is as follows:
{
xmpp: {
connection: {
jid: 'bot@localhost',
password: 'mysecretpassword'
},
muc: {
room: 'chat',
server: 'localhost',
nick: 'commander',
password: 'letmein',
/* roles: [ 'moderator', 'participant', 'visitor' ] */
},
admins: [
'fail@localhost',
/lloyd@[^localhost]/,
function(stanza, context) {
return true
}
]
}
}
The connection key contains details for the bot to connect to the XMPP server. These values are passed directly to the constructor of the node-xmpp-client. For more connection choices please see the linked manual.
Using the admin key within xmpp section of the configuration to set what XMPP JIDs can make requests to the chat bot. There are three methods by which you can define allowed JIDs:
The admin matching methods are called in order, if any of the methods provide a match then the command will be accepted.
The bare JID of the sender is compared to the provided values.
The bare JID of the sender is compared to the provided value using a regular expression match.
The original stanza is passed to your provided function, return true or false in order tell the bot whether to accept this request.
By providing details under the muc key. The minimum keys are 'room', 'server', and 'nick' (nickname). If the room is password protected then adding the password to the 'password' key will allo you to connect. You can control which roles can send commands by setting the 'roles' key.
In MUC rooms the bot can be talked as follows:
bot-nick: do_stuff
{
commands: {
'cat': {
command: 'cat',
reply: true,
summary: 'Cat a file',
description: 'Return the contents of a file'
arguments: /^[a-z0-9]*$/i,
options: { timeout: 2000 }
}
}
}
Using the commands key of the bot configuration allows you to set up commands. It takes the form of a keyed object with the key being the command identifier.
The command to be run
If set to false then the command is run without any response returned.
A summary of the command being run - included in the help response.
A longer description of the command being run.
If arguments are accepted for the command then they can be expected here:
There is an upstart script located in contrib/xmpp-command-bot.conf. Copy this to /etc/init/ then run:
sudo service xmpp-command-bot start
The script is set up to run out of /usr/share/xmpp-command-bot and as the user xmpp.
npm test
DEBUG=* node index
Various values for debug can be used, currently the following are supported:
MIT
FAQs
An XMPP chat bot for running local commands
The npm package xmpp-command-bot receives a total of 42 weekly downloads. As such, xmpp-command-bot popularity was classified as not popular.
We found that xmpp-command-bot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.