
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
vue、TS、axios等
npm i || yarn || cnpm
1.打包压缩
npm run build || yarn build
2.运行方式:
方式一:npm install http-server -g
http-server 6600
访问/引用链接(在business-demo项目):ip地址:6600/payH5sdk.js(如:http://172.16.16.246:6600/payH5sdk.js)
方式二:本地起node服务
将dist下文件放入node项目publish下
访问/引用链接(在business-demo项目):http://localhost:3000/payH5sdk.js
方式三:上传代码到dev
在项目(payH5Sdk)上传任意更改到dev
访问/引用链接(在business-demo项目):http://pay-h5sdk1.dev.eusdk.com/payH5sdk.js
npm run lint
## 项目结构
.
├── README.md ------------------------ 说明文件
├── package.json --------------------- 项目配置
├── alipay_in_weixin ----------------- 支付引导页(页面需放到服务器生成链接使用)
├── └──pay -------------------------- 微信内无法使用支付宝支付处理(详见:https://docs.open.alipay.com/203/105285/)
├── build ---------------------------- webpack配置入口
├── └──webpack.config.js ------------ webpack配置
├── dist ----------------------------- 打包后的文件位置
├── └── index.html ------------------- 入口页面
├── └── pay.htm ---------------------- 微信内无法使用支付宝支付处理(详见:https://docs.open.alipay.com/203/105285/)
├── └── payH5sdk.js ------------------ 打包后的主要文件
└── src ------------------------------ 源码目录
├── payStyle --------------------- 支付
├── └── alipayH5 ---------------- 支付宝支付
├── └── paypal ------------------ PayPal支付
├── └── unionPay ---------------- 银联支付
├── └── wechatH5 ---------------- 微信h5支付
├── └── wechatJsapi ------------- 微信内支付
├── template --------------------- 模版文件位置
├── └── index ------------------ 模板文件是./src/template/index.html
├── utils ------------------------ 状态管理
├── └── axios -------------------- 请求函数
├── └── checkoutParams ----------- 参数检查函数(是否缺少参数等)
├── └── encode ----------------- 编码函数
├── └── os ----------------------- 检测设备环境函数(设备:mobile/pc,是否微信环境)
├── └── osMap -------------------- 环境参数处理(mobile/pc/微信环境)
├── └── productMap --------------- 支付方式判断函数(映射支付产品参数)
├── └── sortParams --------------- 参数排序生成签名函数(排序-赋值-某种顺序拼接-拷贝字符)
├── views ------------------------ 页面集合目录
├── index ------------------------ 主要处理函数(也是打包入口文件)
└── index.d.js ------------------- ts全局配置
FAQs
> vue、TS、axios等
We found that ys-pay demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.