
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
π A Python tool to automate and manage Telegram channel content with encryption and scheduling support.
This repository hosts a GitHub Actions workflow to automate tasks for TelePostKeeper (TPK), a tool for managing and posting content to Telegram channels efficiently. The bot is designed to run directly within GitHub Actions, leveraging the platformβs robust environment for scheduling, event-based triggers, and task automation.
Go to your repositoryβs Settings > Secrets and Variables > Actions, and add the following:
Add the following in Settings > Secrets and Variables > Actions (Variables):
TPK_STORE_DIR: Directory for storing processed data (e.g., data/).
TPK_ENCRYPT_AES_KEY_BASE64: A Base64-encoded AES encryption key for secure data handling.
TPK_ENCRYPT_AES_IV_BASE64: Initialization Vector for AES encryption (Base64-encoded).
TPK_CHANNELS_IDS_LIST_ENCRYPTED: AES-encrypted list of channel IDs (if using encryption).
Generate keys on any wabsite like this
https://generate.plus/en/base64
To test decryption try there (all inputs in base64)
https://emn178.github.io/online-tools/aes/decrypt/
The bot uses a pre-configured GitHub Actions workflow. The file is located at .github/workflows/tpk-runner.yml. It includes the following triggers:
Commit the changes to your repository and push them to GitHub. The workflow will start running automatically based on the defined triggers.
Below is the full workflow used to run the bot:
name: π tpk-runner
run-name: π tpk-runner (${{ github.actor }}) π
on:
schedule:
- cron: '*/10 * * * *' # Runs every 10 minutes
push:
branches:
- main # Trigger on pushes to the main branch
release:
types: [published] # Trigger on new releases
permissions:
contents: write # Required for auto-commit
jobs:
tpk-runner:
runs-on: ubuntu-latest
env:
TPK_BOT_TOKEN: ${{ secrets.TPK_BOT_TOKEN }}
TPK_ENCRYPT_AES_KEY_BASE64: ${{ secrets.TPK_ENCRYPT_AES_KEY_BASE64 }}
TPK_CHANNELS_IDS_LIST: ${{ vars.TPK_CHANNELS_IDS_LIST }}
TPK_CHANNELS_IDS_LIST_ENCRYPTED: ${{ vars.TPK_CHANNELS_IDS_LIST_ENCRYPTED }}
TPK_ENCRYPT_AES_IV_BASE64: ${{ vars.TPK_ENCRYPT_AES_IV_BASE64 }}
TPK_SKIP_DOWNLOAD_BIGGER: ${{ vars.TPK_SKIP_DOWNLOAD_BIGGER }}
TPK_STORE_DIR: ${{ vars.TPK_STORE_DIR }}
steps:
- name: π Checkout repository
uses: actions/checkout@v4
- name: π Set up Python environment
uses: actions/setup-python@v3
with:
python-version: '3.x'
- name: π Install TPK
run: pip install telepostkeeper
- name: π Install process-time-killer
run: pip install process-time-killer
- name: π‘ Listening
run: timekiller "telepostkeeper" --timeout 30
- name: πΌ Frontend
run: telepostkeeper-frontend
- name: Get current date-time
run: echo "COMMIT_MESSAGE=$(date '+%Y-%m-%d %H:%M:%S')" >> $GITHUB_ENV
- name: πΎ Git Auto Commit
uses: stefanzweifel/git-auto-commit-action@v4
with:
commit_message: ${{ env.COMMIT_MESSAGE }}
This project is licensed under the MIT License.
FAQs
π A Python tool to automate and manage Telegram channel content with encryption and scheduling support.
We found that telepostkeeper demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socketβs new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.