
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@qortexdevs/y-websocket
Advanced tools
WebSocket Provider for Yjs forked from y-websocket for HTTPS support
The Websocket Provider implements a classical client server model. Clients connect to a single endpoint over Websocket. The server distributes awareness information and document updates among clients.
The Websocket Provider is a solid choice if you want a central source that handles authentication and authorization. Websockets also send header information and cookies, so you can use existing authentication mechanisms with this server.
import * as Y from 'yjs'
import { WebsocketProvider } from 'y-websocket'
const doc = new Y.Doc()
const wsProvider = new WebsocketProvider('ws://localhost:1234', 'my-roomname', doc)
wsProvider.on('status', event => {
console.log(event.status) // logs "connected" or "disconnected"
})
The WebSocket provider requires a WebSocket object to create connection to a server. You can polyfill WebSocket support in Node.js using the ws package.
const wsProvider = new WebsocketProvider('ws://localhost:1234', 'my-roomname', doc, { WebSocketPolyfill: require('ws') })
import { WebsocketProvider } from 'y-websocket'
wsProvider = new WebsocketProvider(serverUrl: string, room: string, ydoc: Y.Doc [, wsOpts: WsOpts])
wsOpts = {
// Set this to `false` if you want to connect manually using wsProvider.connect()
connect: true,
// Specify a query-string that will be url-encoded and attached to the `serverUrl`
// I.e. params = { auth: "bearer" } will be transformed to "?auth=bearer"
params: {}, // Object<string,string>
// You may polyill the Websocket object (https://developer.mozilla.org/en-US/docs/Web/API/WebSocket).
// E.g. In nodejs, you could specify WebsocketPolyfill = require('ws')
WebsocketPolyfill: Websocket,
// Specify an existing Awareness instance - see https://github.com/yjs/y-protocols
awareness: new awarenessProtocol.Awareness(ydoc)
}
wsProvider.wsconnected: boolean
wsProvider.wsconnecting: boolean
wsProvider.shouldConnect: boolean
wsProvider.bcconnected: boolean
wsProvider.synced: boolean
wsProvider.disconnect()
wsProvider.connect()
wsProvider.destroy()
wsProvider.on('sync', function(isSynced: boolean))
PORT=1234 npx y-websocket-server
MODE=https PORT=1234 SSL_PRIVATE_KEY_PATH=/path/to/privkey.pem SSL_FULL_CHAIN_PATH=/path/to/fullchain.pem npx y-websocket-server
Since npm symlinks the y-websocket-server executable from your local ./node_modules/.bin folder, you can simply run npx. The PORT environment variable already defaults to 1234. The MODE environment variable defaukts to http.
To enable HTTPS set
MODE to httpsSSL_PRIVATE_KEY_PATH to privatekey.pem locationSSL_FULL_CHAIN_PATH to fullchain.pem locationPersist document updates in a LevelDB database.
See LevelDB Persistence for more info.
HTTPS
PORT=1234 YPERSISTENCE=./dbDir node ./node_modules/y-websocket/bin/server.js
MODE=https PORT=1234 SSL_PRIVATE_KEY_PATH=/path/to/privkey.pem SSL_FULL_CHAIN_PATH=/path/to/fullchain.pem YPERSISTENCE=./dbDir node ./node_modules/y-websocket/bin/server.js
MODE=http only)Send a debounced callback to an HTTP server (POST) on document update.
Can take the following ENV variables:
CALLBACK_URL : Callback server URL
CALLBACK_DEBOUNCE_WAIT : Debounce time between callbacks (in ms). Defaults to 2000 ms
CALLBACK_DEBOUNCE_MAXWAIT : Maximum time to wait before callback. Defaults to 10 seconds
CALLBACK_TIMEOUT : Timeout for the HTTP call. Defaults to 5 seconds
CALLBACK_OBJECTS : JSON of shared objects to get data:
{
"OBJECT_NAME": "OBJECT_TYPE"
}
CALLBACK_URL=http://localhost:3000/ CALLBACK_OBJECTS='{"prosemirror":"XmlFragment"}' npm start
This sends a debounced callback to localhost:3000 2 seconds after receiving an update (default DEBOUNCE_WAIT) with the data of an XmlFragment named "prosemirror" in the body.
Conspectus — online notes
FAQs
Websockets provider for Yjs with HTTPS support
We found that @qortexdevs/y-websocket demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.