
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@web4/bitbeam
Advanced tools
A 1-1 end-to-end encrypted internet pipe powered by Bitswarm and Noise
npm install @web4/bitbeam
const Bitbeam = require('@web4/bitbeam')
// 'neznr3z3j44l7q7sgynbzpdrdlpausurbpcmqvwupmuoidolbopa' is 32-byte unique passphrase
// to find the other side of your pipe.
// once the other peer is discovered it is used to derive a noise keypair as well.
const beam = new Bitbeam('neznr3z3j44l7q7sgynbzpdrdlpausurbpcmqvwupmuoidolbopa')
// to generate a passphrase, leave the constructor empty and bitbeam will generate one for you
// const beam = new Bitbeam()
// beam.key // <-- your passphrase
// make a little chat app
process.stdin.pipe(beam).pipe(process.stdout)
Part of the BitWeb CLI
Provided here as a standalone CLI as well.
First install it
npm install -g @web4/bitbeam
Then on one machine run
echo 'hello world' | bitbeam
This will generate a phrase, eg "neznr3z3j44l7q7sgynbzpdrdlpausurbpcmqvwupmuoidolbopa". Then on another machine run
# will print "hello world"
bitbeam neznr3z3j44l7q7sgynbzpdrdlpausurbpcmqvwupmuoidolbopa
That's it! Happy piping.
const stream = new Bitbeam([key][, options])Make a new Bitbeam duplex stream.
Will auto connect to another peer using the same key with an end to end encrypted tunnel.
When the other peer writes it's emitted as data on this stream.
Likewise when you write to this stream it's emitted as data on the other peers stream.
If you do not pass a key into the constructor (the passphrase), one will be generated and put on stream.key.
options include:
dht: A DHT instance. Defaults to a new instance.stream.keyThe passphrase used by the stream for connection.
MIT
FAQs
A 1-1 end-to-end encrypted internet pipe powered by Bitswarm
We found that @web4/bitbeam demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.