
Research
5 Malicious Chrome Extensions Enable Session Hijacking in Enterprise HR and ERP Systems
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.
grenache-nodejs-http
Advanced tools
Grenache is a micro-framework for connecting microservices. Its simple and optimized for performance.
Internally, Grenache uses Distributed Hash Tables (DHT, known from Bittorrent) for Peer to Peer connections. You can find more details how Grenche internally works at the Main Project Homepage
npm install --save grenache-nodejs-http
Install Grenache Grape: https://github.com/bitfinexcom/grenache-grape:
npm i -g grenache-grape
// Start 2 Grapes
grape --dp 20001 --aph 30001 --bn '127.0.0.1:20002'
grape --dp 20002 --aph 40001 --bn '127.0.0.1:20001'
This RPC Server example announces a service called rpc_test
on the overlay network. When a request from a client is received,
it replies with world. It receives the payload hello from the
client.
The client sends hello and receives world from the server.
Internally the DHT is asked for the IP of the server and then the request is done as Peer-to-Peer request via websockets.
Grape:
grape --dp 20001 --aph 30001 --bn '127.0.0.1:20002'
grape --dp 20002 --aph 40001 --bn '127.0.0.1:20001'
Server:
const Link = require('grenache-nodejs-link')
const link = new Link({
grape: 'http://127.0.0.1:30001'
})
link.start()
const peer = new PeerRPCServer(link, {
timeout: 300000
})
peer.init()
const service = peer.transport('server')
service.listen(_.random(1000) + 1024)
setInterval(function () {
link.announce('rpc_test', service.port, {})
}, 1000)
service.on('request', (rid, key, payload, handler) => {
console.log(payload) // hello
handler.reply(null, 'world')
})
Client:
const Link = require('grenache-nodejs-link')
const link = new Link({
grape: 'http://127.0.0.1:30001'
})
link.start()
const peer = new PeerRPCClient(link, {})
peer.init()
peer.request('rpc_test', 'hello', { timeout: 10000 }, (err, data) => {
if (err) {
console.error(err)
process.exit(-1)
}
console.log(data) // world
})
Always emitted as son as a request arrives. Emits the raw req and res streams
of the request and some preparsed metadata. Used for streaming. If
disableBuffered is set to false, the server will attempt to buffer after
emitting the stream event.
serviceStr.on('stream', (req, res, meta, handler) => {
console.log(meta) // meta.isStream === true
const [rid, key] = meta.infoHeaders
req.pipe(process.stdout)
handler.reply(rid, null, 'world') // convenience reply
})
Emitted when a request from a RPC client is received. In the lifecycle of a
request this happens after the server has parsed an buffered the whole data.
When the server runs with disableBuffered: true, the event must emitted manually,
if needed, or by calling the buffering request handlers manually.
rid unique request idkey name of the servicepayload Payload sent by clienthandler Handler object, used to reply to a client.service.on('request', (rid, key, payload, handler) => {
handler.reply(null, 'world')
})
link <Object> Instance of a Link Classoptions <Object>
disableBuffered <Boolean> Disable automatic buffering of the incoming request data stream. Useful for streaming.timeout <Object> Server-side socket timeoutsecure <Object> TLS options
key <Buffer>cert <Buffer>ca <Buffer>requestCert <Boolean>rejectUnauthorized <Boolean>Creates a new instance of a PeerRPCServer, which connects to the DHT
using the passed link.
Sets the peer active. Must get called before we get a transport to set up a server.
Must get called after the peer is active. Sets peer into server- mode.
Lets the PeerRPCServer listen on the desired port. The port is
stored in the DHT.
Port of the server (set by listen(port)).
This RPC Server example announces a service called rpc_test
on the overlay network. When a request from a client is received,
it replies with world. It receives the payload hello from the
client.
The client sends hello and receives world from the server.
Internally the DHT is asked for the IP of the server and then the request is done as Peer-to-Peer request via websockets.
Server:
const Link = require('grenache-nodejs-link')
const link = new Link({
grape: 'http://127.0.0.1:30001'
})
link.start()
const peer = new PeerRPCServer(link, {})
peer.init()
const service = peer.transport('server')
service.listen(_.random(1000) + 1024)
setInterval(function () {
link.announce('rpc_test', service.port, {})
}, 1000)
service.on('request', (rid, key, payload, handler) => {
console.log(payload) // hello
handler.reply(null, 'world')
})
Client:
const Link = require('grenache-nodejs-link')
const link = new Link({
grape: 'http://127.0.0.1:30001'
})
link.start()
const peer = new PeerRPCClient(link, {})
peer.init()
peer.request('rpc_test', 'hello', { timeout: 10000 }, (err, data) => {
if (err) {
console.error(err)
process.exit(-1)
}
console.log(data) // world
})
link <Object> Instance of a Link Classoptions <Object>
maxActiveKeyDests <Number>maxActiveDestTransports <Number>secure <Object> TLS options
key <Buffer>cert <Buffer>ca <Buffer>rejectUnauthorized <Boolean>Creates a new instance of a PeerRPCClient, which connects to the DHT
using the passed link.
A PeerRPCClient can communicate with multiple Servers and map work items over them.
With maxActiveKeyDests you can limit the maximum amount of destinations.
Additionally, you can limit the amount of transports with maxActiveDestTransports.
Sets the peer active. Must get called before we start to make requests.
name <String> Name of the service to addresspayload <String> Payload to sendoptions <Object> Options for the request
timeout <Number> timeout in mslimit <Number> maximum requests per available workercallback <Function>Maps a number of requests over the amount of registered workers / PeerRPCServers. Example.
name <String> Name of the service to addresspayload <String> Payload to sendoptions <Object> Options for the request
timeout <Number> timeout in msretry <Number> attempts to make before giving up. default is 1callback <Function>Sends a single request to a RPC server/worker. Example.
name <String> Name of the service to addressoptions <Object> Options for the request
timeout <Number> timeout in msheaders <Object> Headers to add to the requestLooks a service up and returns a req-object which is a stream. Additional parameters (e.g. content-type), can be added via options.
The default metadata values for the request id and key are automatically via header.
FAQs
Granache Node.js HTTP implementation
We found that grenache-nodejs-http demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.