Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
ble-serialport
Advanced tools
A virtual node-serialport implementation that uses BLE as the transport.
First you need git and node.js to clone this repo and install dependencies:
git clone https://github.com/elin-moco/ble-serialport
cd ble-serialport
npm install
npm install --dev
Secondly, you'll need an Arduino board with BleShield added on top of it, put an LED on pin 7, connect Arduino to you computer, and upload this BleFirmataSketch firmware to it.
To use BLE to send/receive data to the device with firmata or Johnny Five, run below gulp tasks to browserify them like:
gulp build
You'll find the browserified scripts in build
folder
Include Johnny Five bundle script in your html file:
<script type="text/javascript" src="j5-bundle.js"></script>
To use with node.js, you'll need these two require statements:
var BleSerialPort = require('ble-serialport').SerialPort;
var five = require('johnny-five');
Then use it directly in your script:
var bsp = new BleSerialPort({address: 'd0:6a:cf:58:ee:bd'}); //put your device name or address here
bsp.connect().then(function() {
var board = new five.Board({port: bsp, repl: false});
board.on('ready', function() {
var led = new five.Led(7);
led.blink();
});
});
And you should see the LED blinks once you have the webapp(page) opened.
Include the firmata bundle script in your html file:
<script type="text/javascript" src="firmata-bundle.js"></script>
To use with node.js, you'll need these two require statements:
var BleSerialPort = require('ble-serialport').SerialPort;
var firmata = require('firmata');
Then use it directly in your script:
var bsp = new BleSerialPort({address: 'd0:6a:cf:58:ee:bd'}); //put your device name or address here
bsp.connect().then(function() {
var board = new firmata.Board(sp);
board.on('ready', function() {
board.digitalWrite(7, board.HIGH);
});
});
And you should see the LED on once you have the webapp(page) opened.
For the fxos-j5 and cordova-j5 example, run following commands to copy bundle script to example/fxos-j5 directory:
gulp dist
For the fxos-j5 example,
modify example/fxos-j5/fxos-j5.js for your device address.
Then install app via WebIDE.
For the node-j5 and node-firmata examples, just update the address and run with:
node node-firmata.js
or
node node-j.js
For the cordova-j5 example, See cordova-j5 readme file for instructions for initialization and deployment.
Currently this implementation uses WebBluetooth V2 API on FxOS, which is still experimental and requires certified permissions for now.
For the hardware part, now only tested with Arduino+BleShield, might need some tweaks for different BLE modules.
See blue-yeast if you are interested in enabling this for other platforms.
FAQs
Virtual serial device over BLE
The npm package ble-serialport receives a total of 8 weekly downloads. As such, ble-serialport popularity was classified as not popular.
We found that ble-serialport demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.