
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
electron-webrtc-patched
Advanced tools
Use WebRTC in Node.js via a hidden Electron process -- forked because the previous maintainer is unavailable
This is a fork of mappum/electron-webrtc that I will maintain until my patches (mappum/electron-webrtc#92 and mappum/electron-webrtc#91) get accepted.
Use WebRTC in Node.js via a hidden Electron process
WebRTC is a powerful web API that lets browsers make peer-to-peer connections, and has already been
deployed in many popular browsers. It may sometimes be
useful to let Node.js programs use WebRTC, e.g. in webtorrent-hybrid. However, the modules for WebRTC in Node (node-webrtc and node-rtc-peer-connection) are either hard to install, broken, or incomplete.
As a hack, this module talks to an invisible Electron instance in the background (using electron-eval) to use Chromium's built-in WebRTC implementation.
This module is compatible with simple-peer and passes its tests.
electron-webrtc is intended for use with RTCDataChannels, so the MediaStream API is not supported.
npm install electron-webrtc
// call exported function to create Electron process
var wrtc = require('electron-webrtc')()
// handle errors that may occur when trying to communicate with Electron
wrtc.on('error', function (err) { console.log(err) })
// uses the same API as the `wrtc` package
var pc = new wrtc.RTCPeerConnection(config)
// compatible with `simple-peer`
var peer = new SimplePeer({
initiator: true,
wrtc: wrtc
})
// listen for errors
wrtc.on('error', function (err, source) {
console.error(err)
})
var wrtc = require('electron-webrtc')([opts])Calling the function exported by this module will create a new hidden Electron process. It is recommended to only create one, since Electron uses a lot of resources.
An optional opts object may contain specific options (including headless mode). See electron-eval
The object returned by this function has the same API as the node-webrtc package.
Any errors that occur when communicating with the Electron daemon will be emitted by the wrtc object (wrtc.on('error', ...)).
wrtc.close()Closes the Electron process and releases its resources. You may not need to do this since the Electron process will close automatically after the Node process terminates.
wrtc.electronDaemonA handle to the electron-eval daemon that this module uses to talk to the Electron process.
errorEmitted by RTCPeerConnection or RTCDataChannel when daemon.eval() evaluates code that throws an internal error.
Chromium normally won't run on a headless server since it expects a screen that it can render to. So to work around this, we can use Xvfb, a utility that creates a framebuffer that Chromium can use as a virtual screen.
First, install Xvfb:
apt-get install xvfb # Ubuntu/Debian
yum install xorg-x11-server-Xvfb # CentOS
Create the HEADLESS env variable:
export HEADLESS=true
Or if you want to do it programmatically, initialize a new instance and pass in headless as a key as demonstrated:
var wrtc = require('electron-webrtc')({ headless: true })
Now you may run your WebRTC code with electron-webrtc :)
FAQs
Use WebRTC in Node.js via a hidden Electron process -- forked because the previous maintainer is unavailable
We found that electron-webrtc-patched demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.