Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
kafka-proxy
Advanced tools
#kafka-proxy
A robust, scalable, high performance WebSockets based proxy for Kafka.
'use strict';
const KafkaProxy = require('kafka-proxy');
let kafkaProxy = new KafkaProxy({
wsPort: 9999,
kafka: 'localhost:9092/',
});
kafkaProxy.listen();
This library adds a few features that Kafka itself doesn’t natively support such as easy connectivity to Kafka over standard web protocols and a central point of management for offsetting, logging, alerting. These capabilities aim to increase agility while in development and can also prove useful in production.
##Features
##Usage
First, create a server which will connect to your Kafka broker(s) and also listening for any incoming web socket connections:
'use strict';
const KafkaProxy = require('kafka-proxy');
let kafkaProxy = new KafkaProxy({
wsPort: 9999,
kafka: 'localhost:9092/',
});
kafkaProxy.listen();
Then create a web socket client to listen for messages on the topic. This can be done easily through:
This is an example wscat connection string:
wscat --connect "ws://127.0.0.1:9999/?topic=test&consumerGroup=group1"
That's it ! Now whenever messages are sent to your Kafka broker for the topic "test", you'll receive them over this WebSocket.
An optional, but recommended, parameter that can be sent over the WebSocket URL is 'offset'. Kafka-Proxy will automatically maintain an offset for you, but there are cases where it can skip forwards (e.g. if your process crashes during receiving a batch, the whole batch can be marked as read). If you need accurate offset management, best results will experienced by maintaining your own offset and passing it into the URL each time. For example:
wscat --connect "ws://127.0.0.1:9999/?topic=test&consumerGroup=group1&offset=1000"
The file ./samples/consumer.js shows an example of managing an offset locally by storing it in a file. Another good option is redis.
Messages are received in batches (according to the set batch size) over the WebSocket in the follolowing format:
[
{"message":"hello one","offset":225107},
{"message":"hello two","offset":225108},
{"message":"hello three","offset":225109}
]
kafka-proxy can be constructed with the following optional parameters:
let kafkaProxy = new KafkaProxy({
wsPort: 9999, // required
kafka: 'localhost:9092/', // required
idleTimeout: 100, // time to wait between batches
maxBytes: 1000000, // the max size of a batch to be downloaded
partition: 0, // the default partition to listen to
auth: 'thisisapassword' // optional authentication
});
Baic HTTP authentication can be enabled by setting the "auth" parameter in the constructor. After this is set, it can be sent over the WebSocket. E.g.
wscat --connect "ws://127.0.0.1:9999/?topic=test&consumerGroup=group1" -H 'authorization: basic thisisapassword'
This is an early project. I started a new, clean repo as the old one had a long and unnecessary commit history. It's a stable code base and we have this running in production for several months. A couple of notes / limitations:
Planned future features:
FAQs
WebSockets based proxy for Kafka
The npm package kafka-proxy receives a total of 0 weekly downloads. As such, kafka-proxy popularity was classified as not popular.
We found that kafka-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.