Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
custom-event-server
Advanced tools
#Overview I love the CustomEvent model in the DOM. A nice simple (name, detail) pairing. So, this is my take on using that same model on the server. In my mind it fits with end-to-end JavaScript to think about end-to-end events.
#Getting Started
##Install
npm install --save custom-event-server
###Simple Server
server = require('custom-event-server')()
server.on 'beep', (name, detail, client) ->
client.fire 'boop', {}
server.on 'woot', (name, detail, client) ->
console.log 'ahhh!'
server.listen 8080
###Simple Client This uses the core-custom-event-client which is a Polymer element.
<core-custom-event-client id="localhost" servers='ws://localhost:8080' onboop='this.server.fire("woot")'>
</core-custom-event-client>
And of course you can addEventListener
, use a jQuery on
, or bind a Polymer
style on-boop='{{}}'
#Theory So the idea is that events coming from the server look and feel like events coming from other DOM elements. And, that instead of RPC/REST/Messages, you fire events on the server.
##Messages This is really just a web socket, but it adopts a (name, detail) protocol. About the only thing to keep in mind is to make sure your detail can be JSON serialized.
##Built Ins
Fired from the server back to your client on a connection or reconnection.
Fired from the client core-custom-event-client
element on a timer.
Pretty much any load balancer or proxy you put in front will time out and tear
down your web socket without this.
Fired from the server back to the client in response to a ping
.
FAQs
Extends the DOM CustomEvent model through to the server
The npm package custom-event-server receives a total of 1 weekly downloads. As such, custom-event-server popularity was classified as not popular.
We found that custom-event-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.