
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A simple realtime chat SDK for web and mobile apps using socket.io with support for end-to-end encryption and multi-tenant backend integration.
This SDK allows you to easily integrate end-to-end encrypted 1-to-1 realtime chat into your app using our hosted microservice.
apiKeynpm install e2ee-chat
"use client";
import React, { useState } from "react";
import useChat from "e2ee-chat/useChat";
export default function ChatBox() {
const [input, setInput] = useState("");
const { messages, sendMessage, joined } = useChat({
serverUrl: "http://localhost:4000",
roomId: "session_abc123",
userId: "user1",
userType: "client",
secretKey: "shared-secret-123",
apiKey: "your-api-key-here",
});
return (
<div>
<h2>Chat</h2>
<ul>
{messages.map((m, i) => (
<li key={i}>
<b>{m.senderId}</b>: {m.decryptedText}
</li>
))}
</ul>
<input value={input} onChange={(e) => setInput(e.target.value)} />
<button onClick={() => sendMessage(input, "user2")}>Send</button>
</div>
);
}
| Option | Type | Required | Description |
|---|---|---|---|
serverUrl | string | ✅ | Your hosted chat server URL |
roomId | string | ✅ | Session ID for the chat |
userId | string | ✅ | Your current user's ID |
userType | string | ✅ | client, handler, or admin |
secretKey | string | ✅ | AES secret used to encrypt/decrypt |
apiKey | string | ✅ | API key to identify your org DB |
Chat history is fetched automatically when the user joins. All messages are decrypted with your secretKey.
You can trigger handler takeover:
const { takeover } = useChat(...);
takeover(); // Makes current user the new handler
To host your own server, clone chat-server and set up .env:
PORT=4000
MONGO_URI=your-default-db-uri
Register your apiKey and mongoUri in the Tenant collection to isolate DB access per organization.
For issues, contact: support@yourchatservice.com
MIT
FAQs
A simple realtime chat SDK for web and mobile apps using socket.io with support for end-to-end encryption and multi-tenant backend integration.
The npm package e2ee-chat receives a total of 33 weekly downloads. As such, e2ee-chat popularity was classified as not popular.
We found that e2ee-chat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.