Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@relaycorp/cloudevents-transport
Advanced tools
Node.js library to send/receive CloudEvents over HTTP binary or any cloud-specific service like GCP PubSub
@relaycorp/cloudevents-transport
This is a Node.js library to send/receive CloudEvents over the following transports:
To create an emitter, simply pass the name of the transport and the channel to the makeEmitter
function. For example:
import type { EmitterFunction } from 'cloudevents';
import { makeEmitter } from '@relaycorp/cloudevents-transport';
const transport = process.env.CE_TRANSPORT_NAME ?? 'ce-http-binary';
const channel = process.env.CE_CHANNEL ?? 'https://cloudevents-broker.com';
const emitter: EmitterFunction = await makeEmitter(transport, channel);
Refer to the documentation of each transport below to learn about the structure channel parameter.
Then the emitter
can be used as a regular EmitterFunction
from the cloudevents
library. For example:
import { CloudEvent } from 'cloudevents';
const event = new CloudEvent({
type: 'com.example.some-event',
source: 'https://example.com',
data: 'Hello, world!',
});
await emitter(event);
To create a receiver, simply pass the name of the transport to the makeReceiver
function. For example:
import { makeReceiver } from '@relaycorp/cloudevents-transport';
const transport = process.env.CE_TRANSPORT_NAME ?? 'ce-http-binary';
const receiver = await makeReceiver(transport);
Then the receiver
can be used to convert cloudevents
Message
s to CloudEventV1
s. For example, using Fastify:
import { makeReceiver } from '@relaycorp/cloudevents-transport';
import type { CloudEventV1 } from 'cloudevents';
import type { FastifyInstance, FastifyPluginOptions } from 'fastify';
export async function registerEventReceiver(server: FastifyInstance): Promise<void> {
// Accept any content type
server.removeAllContentTypeParsers();
server.addContentTypeParser('*', { parseAs: 'buffer' }, (_request, payload, next) => {
next(null, payload);
});
// Initialise the receiver once and reuse it across requests
const transport = process.env.CE_TRANSPORT_NAME ?? 'ce-http-binary';
const convertMessageToEvent = await makeReceiver(transport);
server.post('/', async (request, reply) => {
let event: CloudEventV1<Buffer>;
try {
event = convertMessageToEvent(request.headers, request.body);
} catch (err) {
return reply.status(400).send({ reason: err.message });
}
return reply.status(200).send({ eventId: event.id });
});
}
This is the standard CloudEvents HTTP transport, in binary mode.
The channel passed to the emitter must be the URL of the CloudEvents endpoint that will receive the events.
This transport doesn't actually use CloudEvents at all -- it simply converts the CloudEvent to a Google PubSub message and vice versa. Fields between the two formats are mapped as follows:
CloudEvent field | PubSub field |
---|---|
id | messageId |
time | publishTime |
data | data |
All other CloudEvents fields, including extensions, are mapped to PubSub attributes with the same name.
The channel passed to the emitter must be the name of the PubSub topic where messages are to be published.
FAQs
Node.js library to send/receive CloudEvents over HTTP binary or any cloud-specific service like GCP PubSub
The npm package @relaycorp/cloudevents-transport receives a total of 2 weekly downloads. As such, @relaycorp/cloudevents-transport popularity was classified as not popular.
We found that @relaycorp/cloudevents-transport demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.