Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
github.com/tinode/chat
Instant messaging server. Backend in pure Go (license GPL 3.0), client-side binding in Java, Javascript, and Swift, as well as gRPC client support for C++, C#, Go, Java, Node, PHP, Python, Ruby, Objective-C, etc. (license Apache 2.0). Wire transport is JSON over websocket (long polling is also available) for custom bindings, or protobuf with gRPC.
Tinode is not XMPP/Jabber. It is not compatible with XMPP. It's meant as a replacement for XMPP. On the surface, it's a lot like open source WhatsApp or Telegram.
This is beta-quality software: feature-complete and stable but probably with a few bugs or missing features. Follow instructions to install and run or use one of the cloud services below. Read API documentation.
The promise of XMPP was to deliver federated instant messaging: anyone would be able to spin up an IM server capable of exchanging messages with any other XMPP server in the world. Unfortunately, XMPP never delivered on this promise. Instant messengers are still a bunch of incompatible walled gardens, similar to what AoL of the late 1990s was to the open Internet.
The goal of this project is to deliver on XMPP's original vision: create a modern open platform for federated instant messaging with an emphasis on mobile communication. A secondary goal is to create a decentralized IM platform that is much harder to track and block by the governments.
An explicit NON-goal: we are not building yet another Slack replacement.
See general instructions or docker-specific instructions.
tinode.conf
file.A public Tinode service is available. You can use it just like any other instant messenger. Keep in mind that demo accounts present in sandbox are not available in the public service. You must register an account using valid email in order to use the service.
TinodeWeb, a single page web app, is available at https://web.tinode.co/ (source). See screenshots below.
Tinode for Android a.k.a Tindroid is stable and functional (source). See the screenshots below. A debug APK is also provided for convenience.
Tinode for iOS a.k.a. Tinodios is stable and functional (source). See the screenshots below.
A sandboxed demo service is available at https://sandbox.tinode.co/.
Log in as one of alice
, bob
, carol
, dave
, frank
. Password is <login>123
, e.g. login for alice
is alice123
. You can discover other users by email or phone by prefixing them with email:
or tel:
respectively. Emails are <login>@example.com
, e.g. alice@example.com
, phones are +17025550001
through +17025550009
.
When you register a new account you are asked for an email address to send validation code to. For demo purposes you may use 123456
as a universal validation code. The code you get in the email is also valid.
User not found or offline
means the server was reset while you were connected. If you see it on the web, reload and relogin. On Android log out and re-login. If the database was changed, delete the app then reinstall.Tino
is a basic chatbot which responds with a random quote to any message.123456
as a verification code. Remove line "debug_response": "123456"
from tinode.conf
to disable this option.All client software has support for internationalization. The following translations are provided:
Language | Server | Webapp | Android | iOS |
---|---|---|---|---|
English | ✓ | ✓ | ✓ | ✓ |
Chinese simplified | ✓ | ✓ | ✓ | ✓ |
Chinese traditional | ✓ | ✓ | ✓ | |
French | ✓ | ✓ | ✓ | |
German | ✓ | ✓ | ||
Hindi | ✓ | |||
Korean | ✓ | ✓ | ||
Portuguese | ✓ | ✓ | ||
Romanian | ✓ | ✓ | ||
Russian | ✓ | ✓ | ✓ | ✓ |
Spanish | ✓ | ✓ | ✓ | ✓ |
Thai | ✓ | |||
Ukrainian | ✓ | ✓ | ✓ | ✓ |
Vietnamese | ✓ |
More translations are welcome. In addition to languages listed above, particularly interested in Arabic, Bengali, Indonesian, Urdu, Japanese, Turkish, Persian.
Words 'chat' and 'instant messaging' in Chinese, Russian, Persian and a few other languages.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.