Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/u35s/rudp
rudp采用请求回应机制,实现了UDP的可靠传输,即接收方检查是否丢失数据,然后向发送方请求丢失的数据,因此发送方必须保留已经发送过的数据一定时间来回应数据丢失。为了减小发送方数据保留量,在每收到n个包时通知发送方n之前的包已经收到可以清除了,另外超过设定的包超时时间后也会清除。
1 创建rudp对象
rudp := rudp.New()
2 发送消息,n 发送的的消息长度,err 是否出错
n ,err := rudp.Send(bts []byte)
3 接受消息,n 返回接受到的的消息长度,err 是否出错
n , err := rudp.Recv(data []byte)
4 更新时间获取要发送的消息,如果设置的sendDelay大于更新tick,update返回nil,下次调用时间到时会返回所有的消息链表
var package *Package = rudp.Update(tick int)
5 相关设置
rudp.SetCorruptTick(n int) //设置超过n个tick连接丢失
rudp.SetExpiredTick(n int) //设置发送的消息最大保留n个tick
rudp.SetSendDelayTick(n int) //设置n个tick发送一次消息包
rudp.SetMissingTime(n int) //设置n纳秒没有收到消息包就认为消息丢失,请求重发
另外rudp也实现了tcp的相关接口,很容易改造现有的tcp项目为rudp
1 监听udp端口
addr := &net.UDPAddr{IP: net.ParseIP("0.0.0.0"), Port: 9981}
conn, err := net.ListenUDP("udp", addr)
if err != nil {
fmt.Println(err)
return
}
2 接受连接
listener := rudp.NewListener(conn)
rconn, err := listener.AcceptRudp()
if err != nil {
fmt.Printf("accept err %v\n", err)
return
}
3 读取消息
data := make([]byte, rudp.MAX_PACKAGE)
n, err := rconn.Read(data)
if err != nil {
fmt.Printf("read err %s\n", err)
return
}
4 发送消息
n , err := rconn.Write([]byte("hello rudp"))
1 拨号
raddr := net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 9981}
//raddr := net.UDPAddr{IP: net.ParseIP("47.89.180.105"), Port: 9981}
laddr := net.UDPAddr{IP: net.IPv4zero, Port: 0}
conn, err := net.DialUDP("udp", &laddr, &raddr)
if err != nil {
fmt.Println(err)
return
}
2 创建conn
rconn := rudp.NewConn(conn, rudp.New())
3 发送消息,同服务端 4 接受消息,同服务端
rudp.SetAtuoSend(bool) 设置rudp是否自动发送消息
rudp.SetSendTick() 设置发送的间隔(为0时自动发送消息不启用)
rudp.SetMaxSendNumPerTick() 设置每个tick可以最大发送的消息数量
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.