Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@ubergrape/wamp1
Advanced tools
Very simple WAMP v1 implementation
$ npm install wamp1
$ component install ubergrape/wamp1
So far there is basically one WAMP implementation for the client side, AutobahnJS. It claims to be tiny without dependencies. It is actually >100K with a lot of dependencies embedded. Plus it has a very ugly promises-based API.
I think I can do better :-)
note: This only implements WAMP1, which is fundamentally different from the still working draft WAMP2, which is a lot more complex.
note: This does not include WAMP-CRA, that should be a separate library on top of this one.
Creates a websocket connection to url
and optionally calls callback
with the
resulting welcome message.
If options.omitSubscribe
is set to true
, subscribe and unsubscribe calls
will not be sent to the server. The events however are routed to the
specified callbacks.
This is useful in case the server will send out events regardless of whether
the client subscribed or not. It will simply reduce network chatter.
This is the underlying WebSocket object. It is using ws in node and stagas/websocket in component, both of which have the same API.
Wamp will forward any event that was subcribed to to a generic event
event.
It will emit a error
event in case the protocol version is not supported or
in case the server sends callresults that were not requested.
This property reflects the session id that the server generates and sends via the handshake.
Subscribe to event
on the server. The callback
is called when the server
sends that event.
Unsubscribe from event
on the server. This takes care of multiple listeners
for you.
Publish an event
with data
to the server.
See the spec for the optional arguments
that control the users getting this event.
This registers the prefix
as uri
on the server.
Really, using complete URIs as event identifiers is just overkill, better to use
simple names to begin with.
This calls method
remotely on the server, passing in args
.
The callback
is called either with an error
or with the result
from the
server.
MIT
Released as free software as part of ChatGrape
FAQs
Very simple WAMP v1 implementation
We found that @ubergrape/wamp1 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.