
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
firebotpy
Advanced tools
This is a pyhton libary to connect to Firebots API. This is a standalone project that is not associated with the offical firebot.
pip install firebotpy
https://firebot.app/
From Firebots Website:
"Firebot is a fully featured open-source bot that can help level up your streams."
-Added getUsersinRoles() method which returns a list of users assigned to a role
-Bug Fixes
-Enable and disable timers
-Firebot Text To Speech
-Role Management
-Get, set, increase counters
-Get system and custom commands
-Rewrote the entire library. No longer need to reference the text file in the local firebot directory. Assumes bot is on localhost
-Added Announce messages
-Added ability to retrive quotes
-Added ability to make new quotes
-Can remove metadata
-Can retrieve user metadata stored in firebots database
-Added ability to get metadata for a users
-Added get_allviewers method to return a list of all viewers in the database
-Changed get_status method to get a boolean type. Returns True if connected and False if not connected
-Bug Fixes
-Added error handling when sending data
-Added a brief description to each method
-Add or remove currency from all online viewers
-Add or remove currency from a specific role
-Added whisper chat from the bot or streamer account
-Added duration for custom variables (default is 0)
-Added getting the value of a counter
-Added set roles for users
-Added remove all users from roles
-Added enable and disable timer
-Added add and remove users to VIP roles
-Added ban and unban users
-Added change scene
-Fixed get_status function
-First Release
FAQs
Python library to connect to Firebots API
We found that firebotpy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.