
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@vanwei-wcs/websocket
Advanced tools
🚀 wcs websocket 🌈.
npm i @vanwei-wcs/websocket
import WCSWebsocket from ' @vanwei-wcs/websocket'
console.log(WCSWebsocket)
const websocketUrl = 'ws://example.com'
const options = []
const wsOptions = {
maxReconnectionDelay: 5000,
minReconnectionDelay: 2000,
maxRetries: Infinity,
enableHeartbeat: true,
debug: false
}
// const loginParams = { token: 'asdasdasd' }
const loginParams = {
name:'admin', key:'ewqweqwe'
}
const ws = new WCSWebsocket(websocketUrl, protocols, wsOptions)
console.log('Created new websocket',ws)
// 登录成功
ws.onLogin = () => {
console.log('WCS Websocket Logined')
}
// 登录失败
ws.onLoginError = () => {
console.log('WCS Websocket Login error')
}
// wcs 消息
ws.onWCSStringMessage = (data) => {
// wcs api 返回数据,如果消息绑定了回调方法,则不会执行此方法
}
// wcs 音视频流
ws.onWCSStreamMessage = (buffer) => {
// 音视频流, 可通过 @vanwei-wcs/stream npm库处理
}
// websocket 打开
ws.onopen = e => {
const loginType = typeof loginParams.token !== 'undefined' ? 'token' : 'name'
ws.login({ ...loginParams }, loginType) // 登录wcs websocket
}
// websocket 关闭
ws.onclose = e => {
console.log(e)
}
// websocket 错误
ws.onerror = e => {
console.log(e)
}
// websocket 重连
ws.onreconnect = e => {
console.log(e)
}
| 参数 | 说明 | 类型 |
|---|---|---|
| WCS_ID | 当前通讯的msg_id的值,一般不需要,对象内部会自动处理,不能设置此值 | number / string |
| isLogin | wcs websocket是否已登录 | boolean |
| 其他还有标准Websocket的属性值,例如:binaryType、url、readyState等 |
标准Websocket 类的参数,默认为空数组 []
| 参数 | 说明 | 类型 | 可选值 | 默认值 |
|---|---|---|---|---|
| enableHeartbeat | 是否开启心跳 | boolean | - | false |
| pingTimeout | 心跳发送时间间隔(毫秒) | number | - | 10000 |
| pongTimeout | 心跳接受时间间隔(毫秒) | number | - | 10000 |
| pingMsg | 心跳消息 | string | - | "\r\n" |
| outputPingMsg | 心跳消息是否能被onWCSStringMessage方法输出 | boolean | - | false |
| maxReconnectionDelay | 最大重连时间间隔(毫秒) | number | - | 10000 |
| minReconnectionDelay | 最小重连时间间隔(毫秒) | number | - | 1000 + Math.random() * 4000 |
| reconnectionDelayGrowFactor | 重连时间增长率,基数为minReconnectionDelay,最大不超过maxReconnectionDelay | number | - | 1.3 |
| minUptime | 暂时可以不设置 | number | - | 5000 |
| connectionTimeout | 连接超时时间(毫秒) | number | - | 4000 |
| maxRetries | 最大重连次数 | number | - | Infinity |
| maxEnqueuedMessages | 最大消息队列数量,重连后成功后会依次发送 | number | - | Infinity |
| startClosed | 是否new之后不自动连接 | boolean | - | false |
| debug | 开启debug模式 | boolean | - | false |
| 方法 | 说明 | 参数 |
|---|---|---|
| sendMessage | 发送api请求,参数有message和ctx,详细解释参见下方sendMessage参数解释 | message,ctx |
| login | 登录wcs websocket,loginParams内容是{token:'aaaaaasdasd'}或者{name:'username',key:'3k4h5k2j3h52j34'},loginType值的是如果loginParams里面含有token则为token,否则是name | loginParams,loginType |
| 方法 | 说明 | 参数 |
|---|---|---|
| onLogin | 登录成功回调 | |
| onLoginError | 登录失败回调 | |
| onWCSMessage | weosocket消息回调,未处理 | string / buffer |
| onWCSStringMessage | websocket api回复消息类回调 | {} |
| onWCSStreamMessage | websocket 流消息回调 | buffer |
| 其他还有标准Websocket的回调,例如:onopen、onclose、onerror、onmessage等 |
message api接口,msg_id可以设置为0,组件内部有自增数字去设置
ctx 执行上下文,具体值有params和cb, params是一个对象,可以放入任何值;cb是一个回调函数,当发送消息时,会添加一个message中msg_id对应ctx的map,当组件内部获取到服务端发来的消息时,如果msg_id的map存在,会执行cb方法(params作为参数),具体使用方法参照下方示例
const message = {namespace:"wcs/main",request:"xxxx"}
const ctx = { params:{ a:'aaa' }, cb:sendMessageCallback }
// const ctx = { params:{ a:'aaa' }, cb:sendMessageCallback.bind(this) } // 有this指向问题使用这种方式
sendMessage(message,ctx)
function sendMessageCallback(res,params){
console.log(res) // api接口返回数据
console.log(params) // { a:'aaa' }
}
文档还未编写完整,详细请咨询有关人员
FAQs
wcs websocket
We found that @vanwei-wcs/websocket demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.