Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@coast-team/sigver
Advanced tools
WebRTC Signaling server based on WebSocket for Netflux API, Javascript client and server side transport API for establishing peer to peer network.
npm install -g @coast-team/sigver
Usage: sigver [options]
Signaling server for WebRTC. Used by Netflux API (https://coast-team.github.io/netflux/)
Options:
-V, --version output the version number
-h, --host <ip> Select host address to bind to (default: 0.0.0.0)
-p, --port <number> Select port to use (default: 8000)
-k, --key <file path> Private key for the certificate.
-c, --cert <file path> The server certificate.
-a, --ca <file path> The additional intermediate certificate or certificates that web browsers will need in order to validate the server certificate.
-h, --help output usage information
Examples:
$ sigver # Signaling server is listening on 0.0.0.0:8000
$ sigver -h 192.168.0.1 -p 80 # Signaling server is listening on 192.168.0.1:80
$ sigver --key ./private.key --cert ./primary.crt --ca ./intermediate.crt --port 443 # Signaling server is listening on 0.0.0.0:443
Server uses Protocol Buffers for encode/decode all messages.
syntax = "proto3";
message Message {
oneof type {
// INCOMING AND OUTCOMING MESSAGES
// Server sends `heartbeat` message each 5 seconds and expects getting the
// same message back. If after 3 tentatives still no response then close the
// connection.
// Server sends a heartbeat every 5 seconds and expects to receive it as well. After three missed heartbeats
bool heartbeat = 1;
// Any message to be exchanged between two peers.
// For instance WebRTC offer, answer and candidates.
Content content = 2;
// INCOMING MESSAGE
// Peer either wants to make sure that he is still a group member or wants
// to become one.
GroupData connect = 3;
// OUTCOMING MESSAGE
// Response to the connect request above. True if the peer is the only member
// of the group or he is connected to at least one group member. Otherwise the
// signaling server subscribes this peer to one of the group member (i.e. the
// content message maybe exchanged) .
bool connected = 4;
}
}
message Content {
uint32 senderId = 1;
uint32 recipientId = 2;
bool lastData = 2; // Indicates that this is the last data to be forwarded
bytes data = 3; // Any data sent by the peer
}
message GroupData {
uint32 id = 1; // Current peer id in the group
repeated uint32 members = 2; // Peer's members view. Maybe an empty array.
}
Server may close the socket with the following codes:
FAQs
Signaling server for Netflux API based on WebSocket
We found that @coast-team/sigver demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.