
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
@foxssake/noray
Advanced tools
A simple connection orchestrator and relay to bulletproof connectivity for your online multiplayer games.
Forked from Natty that aims to cover an extended scope.
If you're already familiar with the topic, noray can help with NAT punchthrough.
If you're not familiar with the issue, I'd highly recommend reading Keith Johnston's article on the topic - it's very easy to follow and sums up the topic really well.
But to give you a short summary:
noray helps by orchestrating the NAT punchthrough process 🔥
Unfortunately, even NAT punchthrough is not always a viable solution, depending on your players' NAT setup.
To make sure that your players can always connect to eachother, noray can act as a relay 🔥
In essence, noray will dedicate a specific port to each player, at which others can send data to them. Any data incoming on this dedicated port will be transmitted as-is to the appropriate player.
NOTE: Relaying only supports UDP traffic.
After cloning the repository, run pnpm install to install all required packages.
noray can be configured through environment variables or a .env file. For available configuration keys and their purpose, please see the example configuration.
To run noray, use pnpm start or pnpm start:prod for production use.
Upon startup, the application will allocate all the configured ports and start
listening for incoming connections. Logs are written to stdout.
To keep things simple, data is transmitted through TCP as newline-separated strings. Each line starts with a command, a space, and the rest of the line is treated as data. Example:
connect-relay host-1
The protocol has no concept of replies, threads, correspondences or anything similar. Think of it as a dumbed-down RPC without return values.
At first, each player has to register as host ( even clients ). This is done by sending the following message to noray over TCP:
register-host
noray will reply with the host's OpenID and PrivateID ( oid and pid ):
set-oid [openid]
set-pid [privateid]
These ID's are needed for any subsequent exchanges with noray.
Don't forget to end your messages with a newline character!
To orchestrate connections, noray will need to know each host's external address. This is done by creating a UDP socket and using that to send the host's PrivateID. This operation is idempotent, so you're free to send multiple packets until you receive a reply.
Upon successful registration, the reply will be OK, otherwise it will be an
error message.
Connecting can be attempted either via NAT punchthrough or relay. Since noray has a limited amount of ports to dedicate to relays, it makes sense to prefer NAT punchthrough whenever possible.
Regardless of which approach is taken, you'll need to host's OpenID. At the moment, sharing OpenID is not taken care of, you'll need a manual solution for that.
Once you have the target's OpenID, you need to send one of the following commands, depending on the approach being taken:
connect [openid]
connect-relay [openid]
The server will reply with the same command in both cases. For NAT
punchthrough, it will reply with the target address and port ( e.g.
87.53.78.15:55759 ). For relaying, it will reply with the target port, since
the target machine will be the noray server itself.
Example responses:
connect 87.53.78.15:55759
connect-relay 49178
Note that both parties will receive the appropriate connect command. When this happens, the parties should attempt a UDP handshake with eachother.
noray is licensed under the MIT license.
FAQs
Online multiplayer orchestrator and potential game platform
We found that @foxssake/noray demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.