Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Faye is a publish-subscribe messaging system based on the Bayeux protocol. It is designed to be used in both Node.js and browser environments, allowing for real-time messaging and communication between clients and servers.
Publish-Subscribe Messaging
This code demonstrates how to set up a Faye server and client for publish-subscribe messaging. The server listens on port 8000, and the client subscribes to the '/messages' channel to receive messages. The client also publishes a message to the same channel.
const faye = require('faye');
// Create a new Faye server
const server = new faye.NodeAdapter({mount: '/faye', timeout: 45});
// Start the server
server.listen(8000);
// Create a client
const client = new faye.Client('http://localhost:8000/faye');
// Subscribe to a channel
client.subscribe('/messages', function(message) {
console.log('Received message:', message);
});
// Publish a message to the channel
client.publish('/messages', {text: 'Hello, world!'});
Client-Server Communication
This code demonstrates client-server communication using Faye. The server is set up to listen on port 8000, and the client subscribes to the '/chat' channel to handle incoming messages. The client also publishes a message to the '/chat' channel.
const faye = require('faye');
// Create a new Faye server
const server = new faye.NodeAdapter({mount: '/faye', timeout: 45});
// Start the server
server.listen(8000);
// Create a client
const client = new faye.Client('http://localhost:8000/faye');
// Define a function to handle incoming messages
function handleMessage(message) {
console.log('Received message:', message);
}
// Subscribe to a channel
client.subscribe('/chat', handleMessage);
// Publish a message to the channel
client.publish('/chat', {user: 'Alice', text: 'Hi there!'});
Browser Integration
This code demonstrates how to integrate Faye with a browser environment. It includes the Faye browser script and sets up a client that subscribes to the '/notifications' channel to receive messages. The client also publishes a message to the same channel.
<script src="https://cdn.jsdelivr.net/npm/faye/browser/faye-browser-min.js"></script>
<script>
// Create a client
var client = new Faye.Client('http://localhost:8000/faye');
// Subscribe to a channel
client.subscribe('/notifications', function(message) {
console.log('Received notification:', message);
});
// Publish a message to the channel
client.publish('/notifications', {title: 'New Notification', body: 'You have a new message!'});
</script>
Socket.IO is a library that enables real-time, bidirectional and event-based communication between web clients and servers. It is built on top of WebSockets and provides additional features such as fallback to HTTP long-polling, automatic reconnection, and rooms/namespaces. Compared to Faye, Socket.IO offers more advanced features and is widely used for real-time applications.
Primus is a flexible and extensible library for real-time communication. It abstracts various real-time frameworks (including WebSockets, Engine.IO, and SockJS) and provides a unified API. Primus allows developers to switch between different real-time frameworks without changing the application code. Compared to Faye, Primus offers more flexibility in terms of underlying transport mechanisms.
Pusher is a hosted service that provides real-time messaging and event broadcasting. It offers a simple API for sending and receiving messages and supports various client libraries for different platforms. Pusher is a managed service, which means developers do not need to set up and maintain their own servers. Compared to Faye, Pusher is easier to set up but comes with a cost for the managed service.
Faye is a set of tools for simple publish-subscribe messaging between web clients. It ships with easy-to-use message routing servers for Node.js and Rack applications, and clients that can be used on the server and in the browser.
1.4.0 / 2020-07-31
Faye::Client
:tls
option to the Ruby client with sub-field :verify_peer
for
configuring TLS verificationtls
option in the Node.js client, whose contents are
forward to the https
and tls
modules as appropriateFAQs
Simple pub/sub messaging for the web
The npm package faye receives a total of 534,449 weekly downloads. As such, faye popularity was classified as popular.
We found that faye demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.