Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
EventSub is a Ruby library for Twitch EventSub webhooks. It is built on the ActiveSupport::Notifications API.
This is forked from stripe_event and modified for use with Twitch EventSub.
# Gemfile
gem "event_sub_events"
# config/routes.rb
mount EventSubEvents::Engine, at: "/my-chosen-path"
# config/initializers/event_sub_events.rb
EventSubEvents.signing_secret = ENV['TWITCH_SIGNING_SECRET']
EventSubEvents.configure do |events|
events.subscribe "channel.ban" do |event|
event.subscription
event.event
end
events.all do |event|
# Handle all event types - logging, etc.
end
end
When a webhook_callback_verification_pending
event is received, the event_sub_events
engine will return the
challenge
response automatically.
class CustomerCreated
def call(event)
# Event handling
end
end
class BillingEventLogger
def initialize(logger)
@logger = logger
end
def call(event)
@logger.info "BILLING:#{event.type}:#{event.id}"
end
end
EventSubEvents.configure do |events|
events.all BillingEventLogger.new(Rails.logger)
events.subscribe 'customer.created', CustomerCreated.new
end
Twitch will cryptographically sign webhook events with a signature which is included with a header sent with the request. Verifying this signature lets your application properly authenticate the request originated from Twitch.
Please set the signing_secret
configuration value:
EventSubEvents.signing_secret = "abc123"
Please refer to Twitch's documentation for more details
You can also supply multiple secrets by sending an array to signing_secrets
like so:
EventSubEvents.signing_secrets = [
"abc123",
"123abc"
]
Bug reports and pull requests are welcome on GitHub at https://github.com/deanpcmad/eventsub-events.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that event_sub_events demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.