
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@confluentinc/kafka-javascript
Advanced tools
confluent-kafka-javascript is Confluent's JavaScript client for Apache Kafka and the Confluent Platform. This is an limited availability library. The goal is to provide an highly performant, reliable and easy to use JavaScript client that is based on node-rdkafka yet also API compatible with KafkaJS to provide flexibility to users and streamline migrations from other clients.
Features:
High performance - confluent-kafka-javascript is a lightweight wrapper around librdkafka, a finely tuned C client.
Reliability - There are a lot of details to get right when writing an Apache Kafka client. We get them right in one place (librdkafka) and leverage this work across all of our clients.
Supported - Commercial support is offered by Confluent.
Future proof - Confluent, founded by the creators of Kafka, is building a streaming platform with Apache Kafka at its core. It's high priority for us that client features keep pace with core Apache Kafka and components of the Confluent Platform.
This library leverages the work and concepts from two popular Apache Kafka JavaScript clients: node-rdkafka and KafkaJS. The core is heavily based on the node-rdkafka library, which uses our own librdkafka library for core client functionality. However, we leverage a promisified API and a more idiomatic interface, similar to the one in KafkaJS, making it easy for developers to migrate and adopt this client depending on the patterns and interface they prefer. We're very happy to have been able to leverage the excellent work of the many authors of these libraries!
To use Schema Registry, use the existing @confluentinc/schemaregistry library that is compatible with this library. For a simple schema registry example, see sr.js.
The following configurations are supported:
Installation on any of these platforms is meant to be seamless, without any C/C++ compilation required.
In case your system configuration is not within the supported ones, a supported version of Python must be available on the system for the installation process. This is required for the node-gyp
build tool..
npm install @confluentinc/kafka-javascript
Yarn and pnpm support is experimental.
Below is a simple produce example for users migrating from KafkaJS.
// require('kafkajs') is replaced with require('@confluentinc/kafka-javascript').KafkaJS.
const { Kafka } = require("@confluentinc/kafka-javascript").KafkaJS;
async function producerStart() {
const kafka = new Kafka({
kafkaJS: {
brokers: ['<fill>'],
ssl: true,
sasl: {
mechanism: 'plain',
username: '<fill>',
password: '<fill>',
},
}
});
const producer = kafka.producer();
await producer.connect();
console.log("Connected successfully");
const res = []
for (let i = 0; i < 50; i++) {
res.push(producer.send({
topic: 'test-topic',
messages: [
{ value: 'v222', partition: 0 },
{ value: 'v11', partition: 0, key: 'x' },
]
}));
}
await Promise.all(res);
await producer.disconnect();
console.log("Disconnected successfully");
}
producerStart();
kafkajs
, you can use the migration guide.node-rdkafka
, you can use the migration guide.An in-depth reference may be found at INTRODUCTION.md.
Bug reports and feedback is appreciated in the form of Github Issues. For guidelines on contributing please see CONTRIBUTING.md
confluent-kafka-javascript v0.4.0
v0.4.0 is a limited availability feature release. It is supported for all usage.
eachBatch
callback (#130).FAQs
Node.js bindings for librdkafka
The npm package @confluentinc/kafka-javascript receives a total of 119,101 weekly downloads. As such, @confluentinc/kafka-javascript popularity was classified as popular.
We found that @confluentinc/kafka-javascript demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.