Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@server-sent-stream/parser
Advanced tools
This is the underlying parsing machinery for @server-sent-stream/web and @server-sent-stream/node. It operates on text data (bring your own decoder), and works in both Node and the browser.
EventStreamParser
This is the parser itself. You provide it with chunks of text, and it'll call your provided callback every event that it parses.
Constructor (onEvent: (data: string, eventType: string, lastEventId: string) => void)
'message'
if the incoming event doesn't specify), and the last seen event ID.push(chunk: string)
onEvent
callback to be called, possibly multiple times.end()
Nothing in the event stream specification says anything about how the chunks will be split up! While the parser handles textual chunks being split at arbitrary points, they must still be valid Unicode. It's entirely possible that a chunk may be split within a multi-byte Unicode code point, and it's your responsibility to handle that properly.
For instance, the following code is very commonly used to parse event streams, and is subtly broken:
// Fetch some URL that returns an event stream
const response = await fetch('https://example.com/events', {body: '...'});
// Read from the response
const reader = response.body.getReader();
while (true) {
// `value` is a Uint8Array containing some portion of the response body.
const {done, value} = await reader.read();
if (done) break;
// This code is BROKEN! If the chunk starts or ends in the middle of a
// multi-byte Unicode character, that character will not be decoded, and
// will be replaced by U+FFFF REPLACEMENT CHARACTER(s) (�).
const textChunk = new TextDecoder().decode(value);
}
You need to use a decoding method that buffers partial Unicode data, like the TextDecoderStream
API:
// Fetch some URL that returns an event stream
const response = await fetch('https://example.com/events', {body: '...'});
// The TextDecoderStream has an internal buffer. If a chunk of bytes ends in the
// middle of a multi-byte character, it will buffer it until the rest of the
// character arrives in the next chunk.
const decoder = new TextDecoderStream();
response.body.pipeThrough(decoder);
// Read from the response
const reader = response.body.getReader();
while (true) {
// `value` is a string, guaranteed to be comprised of complete code points.
const {done, value} = await reader.read();
if (done) break;
// We can now do whatever we want with `value`, e.g. parse it...
}
FAQs
Parser for server-sent events
We found that @server-sent-stream/parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.