Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
As this package allows you to easily generate a user access token with the specified permissions, it too has access to send your token off to a third party without your knowledge. You are advised to always check the source code for such operations of any application you use and make sure this isn't the case.
It would be best for you to search through the entire package to assure you aren't being mislead. However, this is time consuming, so if you're not inclined, here are links to the supposedly relevant files. You can also browse the files after installation to make sure the published content doesn't differ from that in the repository.
python -m pip install mytwitch
http://localhost:
followed by the port you choose to use. By default, this package uses 6319
. This would be http://localhost:6319
.NOTE: Client IDs are public and may be shared. You may use Mytwitch's client ID, but you're advised to set up your own application in case this were to ever get removed for any reason. Mytwitch's client ID can be imported from mytwitch.client_id
.
from mytwitch.auth import UserToken
from mytwitch.irc import TwitchIRC
client_id = 'abcdefghijklmnopqrstuvwxyz0123456789'
scope = ['chat:read'] # Permissions to read chat
# Create a user access token for authentication
user_token = UserToken(client_id, scope)
channel = 'twitch' # Which channel to connect to
irc = TwitchIRC(user_token, [channel]) # Create your IRC
# Read incoming messages
for message in irc.feed():
print(message)
from mytwitch.auth import UserToken
from mytwitch.pubsub import TwitchPubSub
client_id = 'abcdefghijklmnopqrstuvwxyz0123456789'
scope = ['channel:read:redemptions'] # Permissions to read reward redemptions
# Create a user access token for authentication
user_token = UserToken(client_id, scope)
# Define a PubSub with your own events
class MyPubSub(TwitchPubSub): # Inherit from `TwitchPubSub`
async def on_open(self, websocket):
print('PubSub has been opened.')
async def on_message(self, ws, message):
print(f'Message received:\n{message}\n\n')
async def on_close(self):
print('PubSub has been closed.')
async def on_error(self, ws, exception):
print(f'An error has occurred:\n{exception}\n\n')
# Topic for reading reward redemption
topics = [f'channel-points-channel-v1.{user_token.user_id}']
pubsub = MyPubSub(user_token, topics) # Create your PubSub
# Start the PubSub connection
pubsub.connect()
from mytwitch.auth import UserToken
client_id = 'abcdefghijklmnopqrstuvwxyz0123456789'
scope = ['chat:read']
user_token = UserToken(
client_id, # Application client ID
scope, # Permissions you want
immed_auth = True # You can set this to False if you don't want
# to generate a token on creation, as it opens a window in the browser
)
# Convert into a string to get the current token or generate a new one if necessary
print(f'My requested token is `{user_token}`')
There are commands for authentication if you don't want to have to set up a file for such simple operations.
These commands use Mytwitch's client ID, by default, but you can specify your own with -C
.
python -m mytwitch auth -NS 'chat:read' 'chat:edit'
python -m mytwitch auth -RT 'abcdefghijklmnopqrstuvwxyz0123456789'
FAQs
Twitch API interaction
We found that mytwitch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.