
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@2bad/onvif
Advanced tools
[](https://www.npmjs.com/package/@2bad/onvif) [](https://opensource.org/license/MIT) [ and Profile G (Replay). This is a stable, typed fork of the original onvif package.
This library provides a wrapper for the ONVIF protocol, allowing you to:
npm install @2bad/onvif
import { Onvif } from '@2bad/onvif';
// Connect to a device
const device = new Onvif({
hostname: '192.168.1.123',
username: 'admin',
password: 'password',
port: 80
});
await device.connect()
// Get snapshot URI
const snapshotUri = await device.media.getSnapshotUri({ profileToken: 'profile1' })
This package maintains compatibility with code written for the original onvif package (v0.6.x) through a compatibility layer. If you're migrating from the original package, your existing code should work with minimal changes.
For detailed API documentation and supported ONVIF commands, please visit our GitHub repository.
This package is based on the excellent work done by agsh and the ONVIF community. We've built upon their foundation to provide a stable, typed implementation for the Node.js ecosystem.
Contributions are welcome! Feel free to submit issues and pull requests.
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
[](https://www.npmjs.com/package/@2bad/onvif) [](https://opensource.org/license/MIT) [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.