Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
MQTT client controlling SwitchBot button & curtain automators, compatible with home-assistant.io's MQTT Switch & Cover platform
MQTT client controlling SwitchBot button automators and curtain motors
Compatible with Home Assistant's MQTT Switch and MQTT Cover platform.
$ pip3 install --user --upgrade switchbot-mqtt
$ switchbot-mqtt --mqtt-host HOSTNAME_OR_IP_ADDRESS --mqtt-enable-tls
# or
$ switchbot-mqtt --mqtt-host HOSTNAME_OR_IP_ADDRESS --mqtt-disable-tls
Use sudo hcitool lescan
or select device settings > 3 dots on top right in
SwitchBot app
to determine your SwitchBot's mac address.
Send ON
or OFF
to topic homeassistant/switch/switchbot/aa:bb:cc:dd:ee:ff/set
.
$ mosquitto_pub -h MQTT_BROKER -t homeassistant/switch/switchbot/aa:bb:cc:dd:ee:ff/set -m ON
The command-line option --fetch-device-info
enables battery level reports on topic
homeassistant/switch/switchbot/MAC_ADDRESS/battery-percentage
after every command.
The report may be requested manually by sending a MQTT message to the topic
homeassistant/switch/switchbot/MAC_ADDRESS/request-device-info
(requires --fetch-device-info
)
Send OPEN
, CLOSE
, or STOP
to topic homeassistant/cover/switchbot-curtain/aa:bb:cc:dd:ee:ff/set
:
$ mosquitto_pub -h MQTT_BROKER -t homeassistant/cover/switchbot-curtain/aa:bb:cc:dd:ee:ff/set -m CLOSE
Or a position in percent (0 fully closed, 100 fully opened) to topic
homeassistant/cover/switchbot-curtain/aa:bb:cc:dd:ee:ff/position/set-percent
:
$ mosquitto_pub -h MQTT_BROKER -t homeassistant/cover/switchbot-curtain/aa:bb:cc:dd:ee:ff/position/set-percent -m 42
The command-line option --fetch-device-info
enables position reports on topic
homeassistant/cover/switchbot-curtain/MAC_ADDRESS/position
after STOP
commands
and battery level reports on topic homeassistant/cover/switchbot-curtain/MAC_ADDRESS/battery-percentage
after every command.
These reports may be requested manually by sending a MQTT message to the topic
homeassistant/cover/switchbot-curtain/MAC_ADDRESS/request-device-info
(requires --fetch-device-info
)
In case some of your Switchbot devices are password-protected,
create a JSON file mapping MAC addresses to passwords
and provide its path via the --device-password-file
option:
{
"11:22:33:44:55:66": "password",
"aa:bb:cc:dd:ee:ff": "secret",
"00:00:00:0f:f1:ce": "random string"
}
$ switchbot-mqtt --device-password-file /some/where/switchbot-passwords.json …
switchbot-mqtt --mqtt-username me --mqtt-password secret …
# or
switchbot-mqtt --mqtt-username me --mqtt-password-file /var/lib/secrets/mqtt/password …
⚠️ --mqtt-password
leaks the password to other users on the same machine,
if /proc
is mounted with hidepid=0
(default).
By default, switchbot-mqtt
prepends homeassistant/
to all MQTT topics.
This common prefix can be changed via --mqtt-topic-prefix
:
# listens on living-room/switch/switchbot/aa:bb:cc:dd:ee:ff/set
switchbot-mqtt --mqtt-topic-prefix living-room/ …
# listens on switch/switchbot/aa:bb:cc:dd:ee:ff/set
switchbot-mqtt --mqtt-topic-prefix '' …
After connecting to the MQTT broker, switchbot-mqtt
will report online
on topic homeassistant/switchbot-mqtt/status
.
When disconnecting (graceful shutdown or unexpected loss of connection), offline
will be reported on the same topic.
Why not use the official SwitchBot integration?
I prefer not to share the host's network stack with home assistant (more complicated network setup and additional netfilter rules required for isolation).
Sadly, docker run --network host
even requires --userns host
:
docker: Error response from daemon: cannot share the host's network namespace when user namespaces are enabled.
The docker image built from this repository works around this limitation by explicitly running as an unprivileged user.
The official home assistant image
runs as root
.
This imposes an unnecessary security risk, especially when disabling user namespace remapping
(--userns host
).
See https://github.com/fphammerle/docker-home-assistant for an alternative.
# https://www.home-assistant.io/docs/mqtt/broker/#configuration-variables
mqtt:
broker: BROKER_HOSTNAME_OR_IP_ADDRESS
# credentials, additional options…
# https://www.home-assistant.io/integrations/switch.mqtt/#configuration-variables
switch:
- platform: mqtt
name: switchbot_button
command_topic: homeassistant/switch/switchbot/aa:bb:cc:dd:ee:ff/set
state_topic: homeassistant/switch/switchbot/aa:bb:cc:dd:ee:ff/state
# http://materialdesignicons.com/
icon: mdi:light-switch
cover:
- platform: mqtt
name: switchbot_curtains
command_topic: homeassistant/cover/switchbot-curtain/11:22:33:44:55:66/set
set_position_topic: homeassistant/cover/switchbot-curtain/aa:bb:cc:dd:ee:ff/position/set-percent
state_topic: homeassistant/cover/switchbot-curtain/11:22:33:44:55:66/state
Pre-built docker images are available at https://hub.docker.com/r/fphammerle/switchbot-mqtt/tags
Annotation of signed tags docker/*
contains docker image digests: https://github.com/fphammerle/switchbot-mqtt/tags
$ docker build -t switchbot-mqtt .
$ docker run --name spelunca_switchbot \
--userns host --network host \
switchbot-mqtt:latest \
switchbot-mqtt --mqtt-host HOSTNAME_OR_IP_ADDRESS
Alternatively, you can use docker-compose
:
version: '3.8'
services:
switchbot-mqtt:
image: switchbot-mqtt
container_name: switchbot-mqtt
network_mode: host
userns_mode: host
environment:
- MQTT_HOST=localhost
- MQTT_PORT=1883
#- MQTT_USERNAME=username
#- MQTT_PASSWORD=password
#- FETCH_DEVICE_INFO=yes
restart: unless-stopped
FAQs
MQTT client controlling SwitchBot button & curtain automators, compatible with home-assistant.io's MQTT Switch & Cover platform
We found that switchbot-mqtt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.