
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@jnode/websocket
Advanced tools
@jnode/websocketSimple WebSocket package for Node.js.
npm i @jnode/websocket
const { WSConnection, calculateWSKey } = require('@jnode/websocket');
@jnode/serverYou can perform a WebSocket handshake within a custom handler:
const { WSConnection, calculateWSKey } = require('@jnode/websocket');
const wsHandler = (ctx) => {
const key = ctx.headers['sec-websocket-key'];
if (!key) throw 400;
// Handshake
ctx.res.writeHead(101, {
'Upgrade': 'websocket',
'Connection': 'Upgrade',
'Sec-WebSocket-Accept': calculateWSKey(key)
});
ctx.res.detachSocket(); // Take control of the socket
const ws = new WSConnection(ctx.req.socket, ctx.req.socket, {
useMask: false // Servers should not mask frames sent to clients
});
ws.on('message', (msg) => {
console.log('Received:', msg.payload);
ws.send(0x1, 'Hello from server!'); // 0x1 is Text frame
});
ws.on('close', (code, reason) => {
console.log(`Closed: ${code} ${reason}`);
});
};
WSConnectionThe core class for managing a WebSocket connection over any duplex stream.
new WSConnection(readable, writable, options)readable <stream.Readable> The input stream (e.g., a TCP socket).writable <stream.Writable> The output stream.options <Object>
maxMessageSize <number> The maximum allowed size for a single message. Default: 1048576 (1MB).useMask <boolean> Whether to mask outgoing frames. Note: Servers MUST NOT mask frames sent to clients, while clients MUST mask frames sent to servers. Default: undefined (treated as false).autoPing <boolean> Whether to automatically reply with a Pong frame when a Ping is received. Default: undefined.ws.send(opcode, payload)opcode <number> The WebSocket opcode (e.g., 0x1 for text, 0x2 for binary).payload <string> | <Buffer> The data to send.writable.write().Sends a single WebSocket frame with fin bit set to 1.
ws.sendFrame(fin, opcode, payload)Low-level method to send a raw WebSocket frame. Useful for manual fragmentation.
ws.close([code[, reason]])code <number> Status code for closure. Default: 1000.reason <string> Human-readable reason for closure.Sends a Close frame and destroys the underlying writable stream.
'message'message <Object>
Emitted when a full message (including fragmented ones) is received.
'close'Emitted when the connection is closed.
'ping' / 'pong'frame <Object> The raw frame object.Emitted when a Ping or Pong frame is received.
calculateWSKey(key)key <string> The Sec-WebSocket-Key header from the client request.Sec-WebSocket-Accept header.A helper function to facilitate the WebSocket handshake process.
FAQs
Simple WebSocket package for Node.js.
We found that @jnode/websocket demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.