
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@xmpp/client
Advanced tools
An XMPP client is an entity that connects to an XMPP server.
@xmpp/client package includes a minimal set of features to connect and authenticate securely and reliably.
It supports Node.js, browsers and React Native. See below for differences.
npm install @xmpp/client @xmpp/debug
import { client, xml, jid } from "@xmpp/client";
or
<script
src="https://unpkg.com/@xmpp/client@VERSION/dist/xmpp.min.js"
crossorigin
></script>
Replace VERSION with the desired version number.
const { client, xml, jid } = window.XMPP;
import { client, xml } from "@xmpp/client";
import debug from "@xmpp/debug";
const xmpp = client({
service: "ws://localhost:5280/xmpp-websocket",
domain: "localhost",
resource: "example",
username: "username",
password: "password",
});
debug(xmpp, true);
xmpp.on("error", (err) => {
console.error(err);
});
xmpp.on("offline", () => {
console.log("offline");
});
xmpp.on("stanza", onStanza);
async function onStanza(stanza) {
if (stanza.is("message")) {
xmpp.removeListener("stanza", onStanza);
await xmpp.send(xml("presence", { type: "unavailable" }));
await xmpp.stop();
}
}
xmpp.on("online", async (address) => {
console.log("online as", address.toString());
// Makes itself available
await xmpp.send(xml("presence"));
// Sends a chat message to itself
const message = xml(
"message",
{ type: "chat", to: address },
xml("body", {}, "hello world"),
);
await xmpp.send(message);
});
await xmpp.start();
See xml package
See jid package
options <Object>
service <string> The service to connect to, accepts an URI or a domain.
domain lookup and connect to the most secure endpoint using @xmpp/resolvexmpp://hostname:port plain TCP, may be upgraded to TLS by @xmpp/starttlsxmpps://hostname:port direct TLSws://hostname:port/path plain WebSocketwss://hostname:port/path secure WebSocketdomain <string> Optional domain of the service, if omitted will use the hostname from service. Useful when the service domain is different than the service hostname.resource <string> Optional resource for resource bindingusername <string> Optional username for saslpassword <string> Optional password for sasltimeout <number Number of miliseconds to wait before timing out (default is 2000)Returns an xmpp object.
xmpp is an instance of EventEmitter.
online indicates that xmpp is authenticated and addressable. It is emitted every time there is a successfull (re)connection.
offline indicates that xmpp disconnected and no automatic attempt to reconnect will happen (after calling xmpp.stop()).
Additional status:
connecting: Socket is connectingconnect: Socket is connectedopening: Stream is openingopen: Stream is openclosing: Stream is closingclose: Stream is closeddisconnecting: Socket is disconnectingdisconnect: Socket is disconnectedYou can read the current status using the status property.
const isOnline = xmpp.status === "online";
You can listen for status change using the status event.
statusEmitted when the status changes.
xmpp.on("status", (status) => {
console.debug(status);
});
errorEmitted when an error occurs. For connection errors, xmpp will reconnect on its own using @xmpp/reconnect however a listener MUST be attached to avoid uncaught exceptions.
<Error>xmpp.on("error", (error) => {
console.error(error);
});
stanzaEmitted when a stanza is received and parsed.
// Simple echo bot example
xmpp.on("stanza", (stanza) => {
console.log(stanza.toString());
if (!stanza.is("message")) return;
const { to, from } = stanza.attrs;
stanza.attrs.from = to;
stanza.attrs.to = from;
xmpp.send(stanza);
});
onlineEmitted when connected, authenticated and ready to receive/send stanzas.
xmpp.on("online", (address) => {
console.log("online as", address.toString());
});
offlineEmitted when the connection is closed an no further attempt to reconnect will happen, after calling xmpp.stop().
xmpp.on("offline", () => {
console.log("offline");
});
Starts the connection. Attempts to reconnect will automatically happen if it cannot connect or gets disconnected.
xmpp.on("online", (address) => {
console.log("online", address.toString());
});
await xmpp.start();
Returns a promise that resolves if the first attempt succeed or rejects if the first attempt fails.
Stops the connection and prevent any further auto reconnect.
xmpp.on("offline", () => {
console.log("offline");
});
await xmpp.stop();
Returns a promise that resolves once the stream closes and the socket disconnects.
Like stop but will not prevent auto reconnect.
xmpp.on("disconnect", () => {
console.log("disconnect");
});
await xmpp.disconnect();
Sends a stanza.
await xmpp.send(xml("presence"));
Returns a promise that resolves once the stanza is serialized and written to the socket or rejects if any of those fails.
Sends multiple stanzas.
Here is an example sending the same text message to multiple recipients.
const message = "Hello";
const recipients = ["romeo@example.com", "juliet@example.com"];
const stanzas = recipients.map((address) =>
xml("message", { to: address, type: "chat" }, xml("body", null, message)),
);
await xmpp.sendMany(stanzas);
Returns a promise that resolves once all the stanzas have been sent.
If you need to send a stanza to multiple recipients we recommend using Extended Stanza Addressing instead.
Returns whether the connection is considered secured.
console.log(xmpp.isSecure());
Considered secure:
This method returns false if there is no connection.
See @xmpp/reconnect.
XMPP supports multiple transports, this table list @xmpp/client supported and unsupported transport for each environment.
| transport | protocols | Node.js | Browser | React Native | Bun | Deno |
|---|---|---|---|---|---|---|
| WebSocket | ws(s):// | ✔ | ✔ | ✔ | ✔ | ✔ |
| TCP | xmpp:// | ✔ | ✗ | ✗ | ✔ | ✔ |
| TLS | xmpps:// | ✔ | ✗ | ✗ | ✔ | ✔ |
Multiple authentication mechanisms are supported.
PLAIN should only be used over secure WebSocket (wss://), direct TLS (xmpps:) or a TCP (xmpp:) connection upgraded to TLS via STARTTLS
| SASL | Node.js | Browser | React Native | Bun | Deno |
|---|---|---|---|---|---|
| ANONYMOUS | ✔ | ✔ | ✔ | ✔ | ✔ |
| PLAIN | ✔ | ✔ | ✔ | ✔ | ✔ |
| SCRAM-SHA-1 | ✔ | ☐ | ✗ | ✔ | ✔ |
FAQs
An XMPP client is an entity that connects to an XMPP server.
The npm package @xmpp/client receives a total of 8,907 weekly downloads. As such, @xmpp/client popularity was classified as popular.
We found that @xmpp/client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.