
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@minescope/mineping
Advanced tools
A simple and efficient JavaScript library for pinging Minecraft servers. It supports both Java and Bedrock editions through a async/await-friendly API.
@minescope/mineping automatically resolves SRV records for Java servers and parses rich status data, including MOTD, player counts, version info, and server icons. Comes with full TypeScript support.
Mirror on my Git
Node.js 14 or newer is required
To install mineping, simply run the following command:
npm i @minescope/mineping
The library exports two main functions: pingJava and pingBedrock. Both are asynchronous and return a Promise.
Java:
import { pingJava } from "@minescope/mineping";
const data = await pingJava("0.0.0.0");
console.log(data)
{
version: { name: '1.21.5', protocol: 770 },
enforcesSecureChat: true,
description: '§1Welcome to §2My Minecraft Server!',
players: { max: 20, online: 0 }
}
Bedrock:
import { pingBedrock } from "@minescope/mineping";
const data = await pingBedrock("0.0.0.0");
console.log(data)
{
edition: 'MCPE',
name: 'Dedicated Server',
levelName: 'Bedrock level',
gamemode: 'Survival',
version: { protocol: 800, minecraft: '1.21.84' },
players: { online: 0, max: 10 },
port: { v4: 19132, v6: 19133 },
guid: 12143264093420916401n,
isNintendoLimited: false,
isEditorModeEnabled: false
}
mineping is an ESM-only module — you are not able to import it with require().
If you cannot switch to ESM, you can use the async import() function from CommonJS to load mineping asynchronously:
const pingJava = (...args) =>
import("@minescope/mineping").then((module) => module.pingJava(...args));
const pingBedrock = (...args) =>
import("@minescope/mineping").then((module) => module.pingBedrock(...args));
mineping uses the debug library to provide detailed tracing information, which can be useful for diagnosing connection issues or understanding the library's internal workings.
To enable debug logs, set the DEBUG environment variable when running your script. The library uses two namespaces:
mineping:java for the Java Edition pinger.mineping:bedrock for the Bedrock Edition pinger.Enable all mineping debug logs:
You can use a wildcard (*) to enable all logs from this library.
DEBUG=mineping:* node your-script.js
DEBUG="mineping:*" node examples/01-basic-ping.jsDEBUG="mineping:*" node examples/01-basic-ping.js
mineping:java pinging Java server hypixel.net with options: {} +0ms
mineping:java attempting SRV lookup for _minecraft._tcp.hypixel.net with 5000ms timeout +2ms
mineping:java SRV lookup successful, new target: mc.hypixel.net:25565 +2ms
mineping:java creating TCP connection to mc.hypixel.net:25565 +0ms
mineping:java socket connected to mc.hypixel.net:25565, sending packets... +182ms
mineping:java received 1440 bytes of data, total buffer size is now 1440 bytes +130ms
mineping:java packet incomplete, waiting for more data +0ms
mineping:java received 12960 bytes of data, total buffer size is now 14400 bytes +1ms
mineping:java packet incomplete, waiting for more data +0ms
mineping:java received 1601 bytes of data, total buffer size is now 16001 bytes +129ms
mineping:java received raw JSON response +0ms
mineping:java successfully parsed full response +0ms
mineping:java cleaning up resources for mc.hypixel.net:25565 +0ms
--- Java Server ---
{
version: { name: 'Requires MC 1.8 / 1.21', protocol: 47 },
players: { max: 200000, online: 28654, sample: [] },
description: ' §aHypixel Network §c[1.8-1.21]\n' +
' §6§lSB 0.23 §2§lFORAGING §8§l- §e§lSUMMER EVENT',
favicon: 'data:image/png;base64,iVBORw0K'... 5738 more characters
}
====================
mineping:bedrock pinging Bedrock server geo.hivebedrock.network:19132 with 5000ms timeout +0ms
mineping:bedrock sending Unconnected Ping packet to geo.hivebedrock.network:19132 +1ms
mineping:bedrock packet: <Buffer 01 c0 01 00 00 00 00 00 00 00 ff ff 00 fe fe fe fe fd fd fd fd 12 34 56 78 19 20 9f 00 e6 ed ef 96> +0ms
mineping:bedrock received 124 bytes from geo.hivebedrock.network:19132 +104ms
mineping:bedrock received raw MOTD string: MCPE;BEDWARS + BUILD BATTLE;121;1.0;13074;100001;-4669279440237021648;Hive Games;Survival +0ms
mineping:bedrock cleaning up resources for geo.hivebedrock.network:19132 +0ms
--- Bedrock Server ---
{
edition: 'MCPE',
name: 'BEDWARS + BUILD BATTLE',
levelName: 'Hive Games',
gamemode: 'Survival',
version: { protocol: 121, minecraft: '1.0' },
players: { online: 13074, max: 100001 },
port: { v4: undefined, v6: undefined },
guid: -4669279440237021648n,
isNintendoLimited: undefined,
isEditorModeEnabled: undefined
}
PowerShell uses different syntax to set environment variables:
$env:DEBUG="mineping:*";node your-script.js
Special thanks to the following projects for inspiration and protocol details:
FAQs
Ping both Minecraft Bedrock and Java servers.
The npm package @minescope/mineping receives a total of 22 weekly downloads. As such, @minescope/mineping popularity was classified as not popular.
We found that @minescope/mineping demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.