
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@sovpro/heos-stream
Advanced tools
Node.js streams for HEOS protocol communication over a socket
Construct an instance with a Socket obtainable via net.createConnection() or new net.Socket()
const {HeosStream} = require ('@sovpro/heos-stream')
const heos_stream = new HeosStream (socket)
Writing requires objects implementing a commmand object interface.
The comand interface is an object with a string command and object params property. command represents the host and pathname of a HEOS command url*.
const command_object = {
command: 'string' ,
params: {
key: value ,
// , key2: value
// , ...
}
}
heos_stream.write (command_object)
The key value pairs correspond to query string parameters that are appended to the HEOS command.
* host and pathname are the command group and command according to the specification.
Reading provides data objects that are one of:
All data provided by HeosStream is a HeosData instance consisting of a message and command property. A HeosResult or HeosEvent is provided if the data is determined to a be a result or an event.
Properties:
message : A key value objectcommand : The command that caused this dataHeosResult represents data that is known to be a command result.
Properties accompanying those from HeosData
result : A string that is either 'success' or 'fail'payload : May be undefined, object or an arrayoptions : May be undefined or an arrayHeosEvent represents data that is known to be a HEOS event.
Properties accompanying those from HeosData
event : A string name of the event (excluding 'event/' prefix)There are two streams emitting data filtered to results (HeosResult) or events (HeosEvent).
An opt-in filtered stream that emits result (HeosResult) data with a command matching on of those provided to the constructor.
const result_stream = new HeosResultStream ([
'player/set_volume' ,
'player/set_mute' ,
'player/toggle_mute' ,
// ...
])
heos_stream.pipe (result_stream)
result_stream.on ('data', result_data => {
// result_data.command will be one of
// the commands provided to the constructor
const {command, message} = result_data
})
An opt-in filtered stream that emits event (HeosEvent) data with a name matching one of those provided to the constructor.
const event_stream = new HeosEventStream ([
'player_volume_changed' ,
// ...
])
heos_stream.pipe (event_stream)
event_stream.on ('data', event_data => {
// event_data.event will be one of
// the events provided the constructor
const {event} = event_data
})
This unsponsored software is provided, subject to a MIT license, unofficially and independently of Sound United, LLC, its affiliates, subsidiaries and brands (such as HEOS, Denon and any such not listed here).
FAQs
Node.js streams for HEOS protocol communication over a socket
We found that @sovpro/heos-stream demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.