
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Forwards HTTP requests to UDP sockets.
At the time of writing, there is no way to send UDP packets from client-side JavaScript running in a web browser. That might seem a strange thing to want to do, but I do have a legitimate use case (I think).
UDP is a common protocol choice for monitoring systems, where the issues of dropped packets and preserving transmission order are typically of lesser importance than the ability to log large numbers of events with minimal overhead. In my case, I need to send client-side RUM data to a UDP monitoring server, but crucially the pages that I am monitoring are being served by a number of different back-end platforms.
Rather than adding a monitoring endpoint to every back-end, it is far simpler for me to create a separate server that can act as a unified proxy, reponsible for sending all of my monitoring data over UDP.
http2udp is a very basic HTTP server that runs on Node.js and forwards requests to UDP sockets, based on the parameters of the request.
Assuming that you already have Node.js and npm, you can install it globally like so:
sudo npm install -g http2udp
Or add it to your project's dependencies
in package.json
and run:
npm install
To see a list of command line options, you can run:
http2udp --help
Available options are:
--host <hostname>:
Hostname to accept HTTP connections on.
The default is 0.0.0.0 (INADDR_ANY).
--port <port>:
Port to accept HTTP connections on.
The default is 8008.
--path <path>:
URL path to accept requests to.
The default is /udp.
--origin <origin>:
Allowed origin(s) for cross-domain requests,
comma separated.
The default is *,
specify null to force same origin.
--maxSize <characters>:
Maximum request body size in characters.
The default is 1024.
--silent:
Prevent the command
from logging output
to the console.
If the server is running in the foreground, you can terminate it with ^C.
If it is running in the background,
find the pid with ps
and kill -9 it,
or just killall http2udp.
var http2udp = require('http2udp');
http2udp.listen({
host: '127.0.0.1', // Defaults to '0.0.0.0' (INADDR_ANY)
port: 80, // Defaults to 8008
path: '/foo/bar', // Defaults to '/udp'
origin: 'http://example.com', // Defaults to '*', may be an array or null
maxSize: 1048576 // Defaults to 1024
log: console.log // Defaults to `function () {}`
});
Yes.
To install dependencies:
npm install
To lint the code:
npm run lint
To run the unit tests:
npm test
FAQs
Forwards HTTP requests to UDP sockets.
The npm package http2udp receives a total of 17 weekly downloads. As such, http2udp popularity was classified as not popular.
We found that http2udp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.