Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@homebridge/ciao
Advanced tools
ciao is a RFC 6763 compliant dns-sd library, advertising on multicast dns (RFC 6762) implemented in plain Typescript/JavaScript
ciao
is a RFC 6763 compliant dns-sd
library,
advertising on multicast dns (RFC 6762)
implemented in plain Typescript/JavaScript.
It is used in HAP-NodeJS and is the successor of the bonjour-hap (and bonjour) library, aiming to be more robust, more maintainable and RFC compliant (read Notice).
ciao
features a multicast dns responder to publish service on the local network.
It will eventually gain browsing functionality in the future to also discover services on the local network
(There is currently no schedule when discover functionality will arrive.
A possible querier implementation is limited as explained in RFC 6762 15.1.
as it can't receive unicast responses).
ciao
passes the Bonjour Conformance Test
as defined and required by Apple.
The full documentation can be found here.
Add ciao
as a dependency to your project by running the following command:
npm install --save @homebridge/ciao
const ciao = require("@homebridge/ciao");
const responder = ciao.getResponder();
// create a service defining a web server running on port 3000
const service = responder.createService({
name: 'My Web Server',
type: 'http',
port: 3000, // optional, can also be set via updatePort() before advertising
txt: { // optional
key: "value",
}
})
service.advertise().then(() => {
// stuff you do when the service is published
console.log("Service is published :)");
});
// ....
service.updateTxt({ // replaces current txt
newKey: "newValue",
});
// ....
service.end().then(() => {
// service is now UNANNOUNCED and can be published again
});
// ....
// frees the service objects (and calls end() if still announced).
// The service object cannot be used again afterwards.
service.destroy();
The full documentation can be found here.
This section links to the most important aspects of the documentation as used in the example above.
First of all the getResponder function should be used to get a reference to a Responder object. The function takes some optional options to configure the underlying mdns server.
The createService method of the Responder
object can now be used to create a new CiaoService
supplying the desired configuration
as the first parameter. You might have a look at the
restrictedAddresses
(and disabledIpv6) configuration
if you don't want to advertise on all available addresses/network interfaces.
The advertise method can now be called
on the service
object to start advertising the service on the network.
An application should ideally listen to the NAME_CHANGED
event, in oder to persist any changes happening to the service name resulting of the conflict resolution algorithm.
The method updateTxt can be used
to update the contest of the txt exposed by the service.
Any application SHOULD hook up a listener on events like SIGTERM or SIGINT and call the shutdown method of the responder object. This will ensure, that goodbye packets are sent out on all connected network interfaces and all hosts on the network get instantly notified of the shutdown. Otherwise, stale data will remain in the caches of surrounding mdns browsers.
As of RFC 6762 17. Multicast DNS Message Size DNS packets must avoid
IP Fragmentation and ensure that all sent packets are smaller than the Maximum Transmission Unit (MTU) defined by
the network interface. The MTU defaults to 1500 Bytes on pretty much all network cards for Ethernet and Wi-Fi.
ciao
can't reliable detect modifications made to this default MTU size.
Thus , we rely on a hardcoded value, which is 1440
for the UDP Payload Size (Remember: the MTU defines the amount
of bytes Ethernet or Wi-Fi can transport on the local link. There is additional overhead caused by the IP Header
and the UDP Header. So the amount of bytes we are able to fit into a single UDP packet is smaller).
If you know, that the MTU differs on your machine, you can set the true UDP Payload Size in bytes
using the CIAO_UPS
environment variable.
As described in RFC 6762 15.: "It is possible to have more than one Multicast DNS responder and/or querier implementation coexist on the same machine, but there are some known issues."
The RFC lists three possible issues:
As the RFC also states in 15.4, it is recommended to use
a single mDNS implementation where possible. It is recommended to use the mdns
library where possible, as the library is pretty much a binding for existing mDNS implementations running on your
system (like mDNSResponder
on macOS or avahi
on most linux based systems).
The one downside with the mdns
library is that running it on Windows is not really straight forward.
Generally we experienced with homebridge
that many users run into problems when trying to install mdns
.
Thus bonjour-hap
and then ciao
was created to provide a much easier to set up system.
FAQs
ciao is a RFC 6763 compliant dns-sd library, advertising on multicast dns (RFC 6762) implemented in plain Typescript/JavaScript
The npm package @homebridge/ciao receives a total of 15,331 weekly downloads. As such, @homebridge/ciao popularity was classified as popular.
We found that @homebridge/ciao demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.