Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Eva is like an EventEmitter, but over WebSockets.
EventEmitter
over WebSocketsDate
, Error
, Buffer
, RegExp
, ArrayBuffer
, TypedArray
, Infinity
, NaN
, and of course everything that you can normally send with JSON. Magic!eva-events
weighs in at only 8 kB extraClient:
var Eva = require('eva-events');
var eva = new Eva('ws://myapp.com');
eva.on('greeting', function (msg) {
console.log(msg); // "Hello world!";
});
Server:
var EvaApp = require('eva-events').Application;
var app = EvaApp(server);
app.on('client', function (eva) {
eva.emit('greeting', 'Hello world!');
});
On the client, .emit()
triggers an event on the server. On the server, .emit()
triggers an event on the client.
Aside, from the .emit()
method, you can also use the .run()
method, which returns a promise which is fulfilled with the return value of the remote event listener. If an Error
object is returned, the promise is rejected with that error.
There are four special events you cannot .emit()
:
ready
done
killed
error
The ready
event is triggered on a client when an open connection has been established and events may be sent back and forth.
The done
event is triggered when the connection starts closing. After this event, neither party may emit new events. The connection will gracefully wait for pending transactions to finish before closing completely (unless there's an error or the connection is killed before then).
The killed
event is triggered when the underlying connection has been completed closed. The first argument of this event is a boolean indicating if the connection was closed cleanly.
The error
event is triggered when a fatal error occurs. This event will always kill the connection immediately after. This cannot be prevented. The first argument of this event is the associated error
object.
Note:
You cannot emit or listen to the newListener
or removeListener
events. Doing so will throw a SyntaxError
.
.run()
If you .run()
an event before the other endpoint has registered a listener for that event, eva
will wait for a response indefinitely. Other things can cause transactions to wait indefinitely too, such as poorly written application code. To prevent this, you can use .timeout()
which causes all new .run()
transactions to fail and kill the connection if they aren't settled after a certain amount of time. You should always listen on the killed
event to react to these things accordingly.
Much of Eva
's awesomeness comes from her apt use of modern web technologies. She requires the Map
object, and WebSocket
with binary support (no legacy versions, only RFC-6455).
Natively, this package is supported by:
However, if you polyfill Map
you can support:
On the client, these instances can be created by invoking the constructor:
var Eva = require('eva-events')
var eva = new Eva('ws://myapp.com/path/to/app')
On the server, these instances are exposed by EvaApplication in the client
event.
Kills the connection. The done
event is immediately emitted. All pending transactions are discarded. It may take some time for the underlying connection to actually close, so when it does, the killed
event is emitted.
Starts to gracefully end the connection. The done
event is immediately emitted. Both endpoints will then wait for all pending transactions to be resolved before finally closing the underlying connection (at which point, the killed
event is emitted).
This emits an event to the opposite endpoint. Remote event listeners are invoked with data as the first argument.
This is the same as .emit()
, except instead of just emitting an event, it starts a transaction. Only the first event listener for the event will fired, and that listener's return value is sent back and made available as the fulfillment value of the promise returned by this method. Or, if the return value is an Error
object, the promise is rejected with it. Promises returned by this method, and promises chained from that promise, have a this
value of the eva
instance. Event listeners can return promises, whose fulfillment values or rejection reasons will be made available as the fulfillment value or rejection reason of the promise returned by this method.
Registers an event listener listener for event eventName.
Same as .on()
, but the listener will only be invoked once.
Unregisters a listener listener that has been registered with event eventName.
Returns the number of event listeners that are registered with event eventName.
Causes all future transactions (started by the .run()
method) to timeout after sec seconds, at which point an error
event will be emitted and the connection will be forcefully killed. A sec value of 0
or Infinity
turns off timeouts.
Default: 0
Sets how long eva
will wait to gracefully end the connection, before timing out and forcefully killing it. A sec value of 0
or Infinity
indicates that eva
will wait forever.
Default: 30
Indicates if the connection is open and events may be sent back and forth.
Returns the number of bytes in the internal buffer. In advanced applications, this can be monitered to adjust network usage rates.
On the server only:
var EvaApp = require('eva-events').Application
var app = EvaApp(server, '/path/to/app', options)
path defaults to "/"
EvaApplication
is an EventEmitter
. When a new client connects, the client
event is emitted with the Eva
client as the first argument. If the EvaApplication
is locked
, and there are no more clients connected, the vacant
event is fired.
You may supply a verifyClients function which must return true
for each client wishing to connect to the WebSocket endpoint. The function may have the following two signatures:
function verifyClients(info) { // synchronous
return false
}
function verifyClients(info, cb) { // asynchronous
cb(false, 401, 'Unauthorized')
}
info is an object with the following properties:
By default, all clients of an EvaApplication
will periodically be sent a heartbeat. If a client endpoint does not respond after 10 heartbeats, the connection will be destroyed. Setting options.useHeartbeat = false
will cause this instance of EvaApplication
to not send and track heartbeats.
Prevents new clients from connecting to the websocket endpoint.
Allows new clients to connect to the websocket endpoint. When an EvaApplication
instance is created, it starts out unlocked.
Locks
the EvaApplication
, and invokes the .kill()
method on each connected client.
Locks
the EvaApplication
, and invokes the .done()
method on each connected client.
Invokes the .emit()
method on each client that isReady
.
Returns a snapshot array of the current clients that are connected.
Returns whether the EvaApplication
is currently rejecting new clients.
FAQs
Eva is like an EventEmitter, but over WebSockets.
The npm package eva-events receives a total of 1 weekly downloads. As such, eva-events popularity was classified as not popular.
We found that eva-events demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.