Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@stomp/stompjs
Advanced tools
@stomp/stompjs is a JavaScript library that provides a STOMP (Simple Text Oriented Messaging Protocol) client for WebSocket communication. It allows you to connect to a STOMP broker over WebSocket, send and receive messages, and handle various messaging scenarios in real-time applications.
Connect to a STOMP broker
This feature allows you to connect to a STOMP broker using WebSocket. You can specify the broker URL, connection headers, and callback functions for connection success and error handling.
const Stomp = require('@stomp/stompjs');
const client = new Stomp.Client({
brokerURL: 'ws://localhost:8080/stomp',
connectHeaders: {
login: 'user',
passcode: 'password'
},
onConnect: () => {
console.log('Connected to the broker');
},
onStompError: (frame) => {
console.error('Broker reported error: ' + frame.headers['message']);
console.error('Additional details: ' + frame.body);
}
});
client.activate();
Subscribe to a topic
This feature allows you to subscribe to a specific topic on the STOMP broker. When a message is sent to that topic, the provided callback function is executed, and the message is processed.
client.onConnect = () => {
client.subscribe('/topic/messages', (message) => {
console.log('Received message: ' + message.body);
});
};
Send a message
This feature allows you to send a message to a specific destination (topic or queue) on the STOMP broker. The message body can be any string.
client.onConnect = () => {
client.publish({
destination: '/topic/messages',
body: 'Hello, world!'
});
};
Handle disconnection
This feature allows you to handle disconnection from the STOMP broker. You can specify a callback function to execute when the client disconnects, and you can also deactivate the client.
client.onDisconnect = () => {
console.log('Disconnected from the broker');
};
client.deactivate();
sockjs-client is a JavaScript library that provides a WebSocket-like object for browsers. It is designed to work with the SockJS server, which provides a WebSocket emulation layer. Unlike @stomp/stompjs, which is specifically for STOMP protocol, sockjs-client focuses on providing a WebSocket-like API with fallback options for older browsers.
webstomp-client is a STOMP client for WebSocket in JavaScript. It is similar to @stomp/stompjs in that it provides STOMP protocol support over WebSocket. However, webstomp-client is a simpler and smaller library, which might be suitable for projects that require a lightweight STOMP client.
rhea is a JavaScript library for messaging using the AMQP protocol. While it is not a STOMP client, it provides similar messaging capabilities over WebSocket and other transports. It is more versatile in terms of protocol support compared to @stomp/stompjs, which is focused solely on STOMP.
This library provides a STOMP over WebSocket client for Web browser and node.js applications.
Please visit https://stomp-js.github.io/ for guides, FAQs and API docs.
This library allows you to connect to a STOMP broker over WebSocket. This library supports complete STOMP specifications including all current protocol variants. Most popular messaging brokers support STOMP and STOMP over WebSockets out-of-the-box or using plugins.
<!--
JSPM Generator Import Map
Edit URL: https://generator.jspm.io/#U2NgYGBkDM0rySzJSU1hcCguyc8t0AeTWcUO5noGega6SakliaYAYTzJAykA
-->
<script type="importmap">
{
"imports": {
"@stomp/stompjs": "https://ga.jspm.io/npm:@stomp/stompjs@7.0.0/esm6/index.js"
}
}
</script>
<!-- ES Module Shims: Import maps polyfill for modules browsers without import maps support (all except Chrome 89+) -->
<script
async
src="https://ga.jspm.io/npm:es-module-shims@1.5.1/dist/es-module-shims.js"
crossorigin="anonymous"
></script>
<script type="module">
import { Client } from '@stomp/stompjs';
const client = new Client({
brokerURL: 'ws://localhost:15674/ws',
onConnect: () => {
client.subscribe('/topic/test01', message =>
console.log(`Received: ${message.body}`)
);
client.publish({ destination: '/topic/test01', body: 'First Message' });
},
});
client.activate();
</script>
$ npm install @stomp/stompjs ws
import { Client } from '@stomp/stompjs';
import { WebSocket } from 'ws';
Object.assign(global, { WebSocket });
const client = new Client({
brokerURL: 'ws://localhost:15674/ws',
onConnect: () => {
client.subscribe('/topic/test01', message =>
console.log(`Received: ${message.body}`)
);
client.publish({ destination: '/topic/test01', body: 'First Message' });
},
});
client.activate();
The API documentation is hosted as GitHub pages for the StompJS family of libraries. You may head straight to the https://stomp-js.github.io/api-docs/latest/
This library comes with detailed usage instructions. Please find it at Usage instructions. Check out other guides at https://stomp-js.github.io/.
There is quite detailed API documentation, you should start at https://stomp-js.github.io/api-docs/latest/classes/Client.html.
if you were using an older version of this library, you would need to make changes to your code. Head to Upgrading.
https://github.com/stomp-js/rx-stomp is based on this library and exposes the entire functionality offered by this library as RxJS Observables.
The npm package includes TypeScript definitions, so there is no need to install it separately.
Please visit Change Log.
If you want to understand the code, develop, or contribute. Please visit How to contribute.
License - Apache-2.0
FAQs
STOMP client for Javascript and Typescript
The npm package @stomp/stompjs receives a total of 186,327 weekly downloads. As such, @stomp/stompjs popularity was classified as popular.
We found that @stomp/stompjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.