Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
yahoo-fantasy
Advanced tools
An API to help facilitate the use of the Yahoo! Fantasy Sports API in NodeJS projects.
This is a node module created to wrap the Yahoo! Fantasy Sports API (link). At the moment, not all subresources are available, nor are any of the 'collection' elements. I do hope to add them, and they have been added to the code, but as of now this project is very much in an open beta phase.
The API is designed to act as a helper for those interacting with the Y! Fantasy API. The goal is for ease of use for the user, both in terms of querying endpoints and parsing responses. I've noticed that in working with the API, the data is not always the easiest to understand, so hopefully what I have created here will help people out.
You can install the module via npm by running:
$ npm install yahoo-fantasy
This module is available under the MIT Licence
More complete documentation can be found using the application sandbox. This sandbox is always a work in progress, if I've learned anything it's that nothing is ever complete.
The API can be used by simply importing the module and querying data, since version 4.0 the authentication flow has been built into the library to make things easier for users.
// import the library
const YahooFantasy = require('yahoo-fantasy');
// you can get an application key/secret by creating a new application on Yahoo!
const yf = new YahooFantasy(
Y!APPLICATION_KEY, // Yahoo! Application Key
Y!APPLICATION_SECRET, // Yahoo! Application Secret
tokenCallbackFunction, // callback function when user token is refreshed (optional)
redirectUri // redirect endpoint when user authenticates (optional)
);
// you can authenticate a user by setting a route to call the auth function
// note: from v4.0 on, public queries are now supported; that is, you can query
// public resources without authenticating a user (ie/ game meta, player meta,
// and information from public leagues)
yf.auth(
response // response object to redirect the user to the Yahoo! login screen
)
// you also need to set up the callback route (defined as the redirect uri above)
// note: this will automatically set the user and refresh token if the request is
// successful, but you can also call them manually, described below
yf.authCallback(
request, // the request will contain the auth code from Yahoo!
callback // callback function that will be called after the token has been retrieved
)
// if you're not authenticating via the library you'll need to set the Yahoo!
// token for the user
yf.setUserToken(
Y!CLIENT_TOKEN
);
// you can do the same for the refresh token...
// if you set this and the token expires (lasts an hour) then the token will automatically
// refresh and call the above "tokenCallbackFunction" that you've specified to persist the
// token elsewhere
yf.setRefreshToken(
Y!CLIENT_REFRESH_TOKEN
);
// query a resource/subresource
yf.{resource}.{subresource} (
{possible argument(s)},
function cb(err, data) {
// handle error
// callback function
// do your thing
}
);
yf.{resource}.{subresource} (
{possible argument(s)}
)
.then(data => // do your thing)
.catch(err => // handle error)
try {
let data = await yf.{resource}.{subresource} (
{possible argument(s)}
)
// do your thing
} catch(err) {
// handle error
}
This project is very much still a work in progress, please report any issues via the GitHub issues page.
promise
based flow for all endpoints as an alternative to callbacks. Thanks Marois!team.stats
resource.user.game_leagues
resource, where the data was not at all user friendly (renamed leagues
to games
at the top level of the return object)FAQs
An API to help facilitate the use of the Yahoo! Fantasy Sports API in NodeJS projects.
The npm package yahoo-fantasy receives a total of 91 weekly downloads. As such, yahoo-fantasy popularity was classified as not popular.
We found that yahoo-fantasy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.