Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The get-port npm package is designed to help developers find an available port on the machine where their code is running. This can be particularly useful in development environments where specific ports may already be in use, or when deploying applications that need to dynamically select an available port to avoid conflicts.
Get an available port
This basic usage of get-port allows you to asynchronously retrieve an available port on the system. The function `getPort()` returns a Promise that resolves to a port number that is currently free on the host machine.
const getPort = require('get-port');
(async () => {
console.log(await getPort());
})();
Specify a preferred port
With get-port, you can also specify a preferred port. If the preferred port is available, it will be returned. Otherwise, get-port will find and return another available port. This is useful when you have a default port for your application but need to automatically switch if it's in use.
const getPort = require('get-port');
(async () => {
console.log(await getPort({port: 3000}));
})();
Get an available port from a range
This feature allows you to specify a range of ports, and get-port will return the first available port from that range. This is particularly useful when you want to limit the ports your application might use to a specific subset.
const getPort = require('get-port');
(async () => {
console.log(await getPort({port: [3000, 3001, 3002]}));
})();
Portfinder is a similar package that helps in getting an available port. Unlike get-port, portfinder starts at a given port and increments until an open port is found. It provides more control over the starting port but doesn't support specifying preferred ports or ranges directly.
This package also aims to find a free port on the host machine. It differs from get-port by allowing users to specify a start and end port, effectively searching for a free port within a given range. It's more focused on range-based searches compared to get-port's more flexible options.
Get an available TCP port.
npm install get-port
import getPort from 'get-port';
console.log(await getPort());
//=> 51402
Pass in a preferred port:
import getPort from 'get-port';
console.log(await getPort({port: 3000}));
// Will use 3000 if available, otherwise fall back to a random port
Pass in an array of preferred ports:
import getPort from 'get-port';
console.log(await getPort({port: [3000, 3001, 3002]}));
// Will use any element in the preferred ports array if available, otherwise fall back to a random port
Use the portNumbers()
helper in case you need a port in a certain range:
import getPort, {portNumbers} from 'get-port';
console.log(await getPort({port: portNumbers(3000, 3100)}));
// Will use any port from 3000 to 3100, otherwise fall back to a random port
Returns a Promise
for a port number.
Type: object
Type: number | Iterable<number>
A preferred port or an iterable of preferred ports to use.
Type: Iterable<number>
Ports that should not be returned.
You could, for example, pass it the return value of the portNumbers()
function.
Type: string
The host on which port resolution should be performed. Can be either an IPv4 or IPv6 address.
By default, it checks availability on all local addresses defined in OS network interfaces. If this option is set, it will only check the given host.
Generate port numbers in the given range from
...to
.
Returns an Iterable
for port numbers in the given range.
Type: number
The first port of the range. Must be in the range 1024
...65535
.
Type: number
The last port of the range. Must be in the range 1024
...65535
and must be greater than from
.
There is a very tiny chance of a race condition if another process starts using the same port number as you in between the time you get the port number and you actually start using it.
Race conditions in the same process are mitigated against by using a lightweight locking mechanism where a port will be held for a minimum of 15 seconds and a maximum of 30 seconds before being released again.
FAQs
Get an available port
The npm package get-port receives a total of 9,030,208 weekly downloads. As such, get-port popularity was classified as popular.
We found that get-port demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.