
Security Fundamentals
Obfuscation 101: Unmasking the Tricks Behind Malicious Code
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
This is an unofficial Zalo API for personal account. It work by simulating the browser to interact with Zalo Web.
Warning: Using this API could get your account locked or banned. We are not responsible for any issues that may happen. Use it at your own risk.
bun install zca-js # or npm install zca-js
See API Documentation for more details.
import { Zalo } from "zca-js";
const zalo = new Zalo();
const api = await zalo.loginQR();
import { Zalo, ThreadType } from "zca-js";
const zalo = new Zalo();
const api = await zalo.loginQR();
api.listener.on("message", (message) => {
const isPlainText = typeof message.data.content === "string";
switch (message.type) {
case ThreadType.User: {
if (isPlainText) {
// received plain text direct message
}
break;
}
case ThreadType.Group: {
if (isPlainText) {
// received plain text group message
}
break;
}
}
});
api.listener.start();
Note: Only one web listener can run per account at a time. If you open Zalo in the browser while the listener is active, the listener will be automatically stopped.
import { Zalo, ThreadType } from "zca-js";
const zalo = new Zalo();
const api = await zalo.loginQR();
// Echo bot
api.listener.on("message", (message) => {
const isPlainText = typeof message.data.content === "string";
if (message.isSelf || !isPlainText) return;
switch (message.type) {
case ThreadType.User: {
api.sendMessage(
{
msg: "echo: " + message.data.content,
quote: message, // the message object to reply to (optional)
},
message.threadId,
message.type, // ThreadType.User
);
break;
}
case ThreadType.Group: {
api.sendMessage(
{
msg: "echo: " + message.data.content,
quote: message, // the message object to reply to (optional)
},
message.threadId,
message.type, // ThreadType.Group
);
break;
}
}
});
api.listener.start();
api.getStickers("hello").then(async (stickerIds) => {
// Get the first sticker
const stickerObject = await api.getStickersDetail(stickerIds[0]);
api.sendMessageSticker(
stickerObject,
message.threadId,
message.type, // ThreadType.User or ThreadType.Group
);
});
See examples folder for more details.
We welcome contributions from the community.
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
Unofficial Zalo API for JavaScript
The npm package zca-js receives a total of 220 weekly downloads. As such, zca-js popularity was classified as not popular.
We found that zca-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
Security News
Join Socket for exclusive networking events, rooftop gatherings, and one-on-one meetings during BSidesSF and RSA 2025 in San Francisco.
Security News
Biome's v2.0 beta introduces custom plugins, domain-specific linting, and type-aware rules while laying groundwork for HTML support and embedded language features in 2025.