
Product
Introducing Socket Scanning for VS Code Marketplace Extensions
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.
@strav/broadcast
Advanced tools
Strav broadcast / pub-sub primitive — Broadcaster interface + MemoryBroadcaster (in-process) + PostgresBroadcaster (polling-ledger backplane) + per-channel authorization. Pairs with @strav/http's router.sse and @strav/notification/broadcast.
In-process and multi-node pub/sub for Strav 1.0. Powers SSE endpoints (router.sse(...) in @strav/http) and the broadcast notification channel (@strav/notification/broadcast). Apps inject the abstract Broadcaster token; the provider in the container picks the concrete driver — MemoryBroadcaster for single-node dev, PostgresBroadcaster for multi-node deployments.
import { Broadcaster } from '@strav/broadcast'
@inject()
class OrdersController {
constructor(private readonly broadcaster: Broadcaster) {}
async pay(req: Request): Promise<Response> {
const order = await this.orders.markPaid(req)
await this.broadcaster.publish(`private-orders.${order.tenantId}`, {
id: order.eventId,
event: 'order.paid',
data: { orderId: order.id, amount: order.amountCents },
})
return new Response(null, { status: 204 })
}
}
Canonical docs live in docs/broadcast/README.md.
| Driver | Subpath | Notes |
|---|---|---|
| Memory | @strav/broadcast (root) + @strav/broadcast/memory | In-process pub/sub. Single-node only. Bounded per-subscription buffer with overflow hooks. |
| Postgres | @strav/broadcast/postgres | Polling-ledger backplane (strav_broadcast_events table). Multi-node. ~250ms p50 latency at default polling interval. |
Per-channel authorization is built into the base class — register exact names or trailing-wildcard patterns ('private-orders.*') via broadcaster.authorize(pattern, fn). Channels with the private- or presence- prefix are denied by default unless an authorizer says yes.
FAQs
Strav broadcast / pub-sub primitive — Broadcaster interface + MemoryBroadcaster (in-process) + PostgresBroadcaster (polling-ledger backplane) + per-channel authorization. Pairs with @strav/http's router.sse and @strav/notification/broadcast.
We found that @strav/broadcast demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

Research
/Security News
Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.

Security News
/Company News
Capital One is partnering with Socket to proactively secure its open source supply chain.