
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
express-socket.io-middleware
Advanced tools
This middleware allows you to use the existing HTTP REST API as a WebSocket.
This middleware allows you to use the existing HTTP REST API as a WebSocket.
The easiest way to install express-socket.io-middleware
is with npm.
npm install express-socket.io-middleware
Alternately, download the source.
git clone https://github.com/stegano/express-socket.io-middleware.git
This middleware allows you to process all rest api requests and responses implemented as websockets.
...
const app = express();
const server = http.createServer(app);
const io = new Server(server, {
path: '/ws',
});
app
.use(socketIoMiddleware(io, 'http://localhost:3000', 'secret!'))
.get('/test', (_, res) => {
res.send({message: 'Hello World'})
});
server.listen(3000);
...
Request through websocket and receive a response
// 1) Create and connect socket object
const socket = io({
path: '/ws',
transports: ['websocket']
});
// 2) Send request using WebSocket
socket.emit('request', {
pathanme: '/test',
method: 'GET',
data: {},
params: {}
});
// 3) Receive response using WebSocket
socket.on('response', (data) => {
console.log(data); // `{ request: {...}, response: { ..., data: 'Hello World' }} }`
});
Request using REST API and receive response using WebSocket
// 1) Create and connect socket object
const socket = io({
path: '/ws',
transports: ['websocket']
});
// 2) Receive auth token via WebSocket
socket.on('token', ({token}) => {
// 3) Send REST API request with `authentication` header
axios.get('/test', {
headers: {
authorization: `Bearer ${token}`
}
})
});
socket.on('response', (data) => {
// 4) Receive REST API response as WebSocket
console.log(data); // `{ request: {...}, response: { ..., data: 'Hello World' }} }`
});
/**
* Send an error message to the socket
* When an unexpected error occurs during internal processing of socketIoMiddleware.
*/
unexpectedErrorMessage?: string
/**
* This setting can transform the response payload data to be sent to the socket.
*/
transformResponsePayload?: (data: ResponsePayload) => any
/**
* This setting can change the socket event name.
*/
eventNames?: {
/**
* When a socket is connected, it sends a JWT. This token contains authentication information
* about the socket to connect to when making an API request.
*/
token?: string
/**
* The name of the event to request with the websocket.
*/
request?: string
/**
* The name of the event that will receive a response to information requested by the websocket.
*/
response?: string
}
__advanced__?: {
/**
* Whether keepalive is enabled when communicating with the server internally
*/
httpKeepAlive?: boolean
/**
* Setting up the axios library that is internally communicating with the server
* @see https://github.com/axios/axios#request-config
*/
axiosRequestConfig?: AxiosRequestConfig
}
This middleware internally sends an HTTP request to the web server and sends the received response value to the connected web socket.
FAQs
This middleware allows you to use the existing HTTP REST API as a WebSocket.
The npm package express-socket.io-middleware receives a total of 63 weekly downloads. As such, express-socket.io-middleware popularity was classified as not popular.
We found that express-socket.io-middleware demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.