Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Beacons is small library to send beacons to your server. It's basically a really
minimal way of doing one way communication in browsers without any dependency on
XHR requests or what ever. Internally it will use Image
to do the actual
requesting of the resource. So this method will not work when images are
blocked. But it's still a great way to send additional debugging information to
your server.
When you receive a beacon request on your server make sure you:
204
and don't return any content.Cookie
headers are not needed and only add pointless bandwidth to these micro
requests.Once the beacon
specification lands in the browsers we will start supporting
it transparently. See http://w3c.github.io/beacon/ for the current working draft.
This module is only written for browser usage and assumes that a node.js module system is used for requiring the module. The module it self is released in npm and can be installed from the CLI using the following command:
npm install --save beacons
The API is as tiny as the module it self. It only exposes one function that does the request. This function accepts 3 arguments, the last 2 are optional.
url
The URL you want to request.fn
An optional completion callback, it will be called when the resource is
loaded, failed to load or times-out. It's not a guarantee that the message is
actually send as that is nearly impossible to detect.timeout
The timeout before the callback is called. Defaults to 1000
ms.So using this module is as simple as:
'use strict';
var beacon = require('beacons');
beacon('http://example.com/poke', function () {
console.log('poked example.com');
});
Last but not least, the suggested code to handle the response on the server using Node.js
require('http').createServer(function (req, res) {
res.statusCode = 404;
if (req.url !== '/poke') return res.end('404');
//
// The actual code that handles the beacon, the code above is just routing of
// the url..
//
res.statusCode = 204; // This prevents the need to send a body.
res.setHeader('Cache-Control', 'no-cache'); // Browsers should never cache this.
res.end('');
});
MIT
FAQs
Minimalistic one way communication
The npm package beacons receives a total of 3 weekly downloads. As such, beacons popularity was classified as not popular.
We found that beacons demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.