
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
WebSocket client for Laravel with full TypeScript support and type safety.
npm install larasopp
# or
yarn add larasopp
# or
pnpm add larasopp
composer require larasopp/larasoppimport Larasopp from 'larasopp';
const larasopp = new Larasopp({
host: 'ws://127.0.0.1:3001',
token: 'your-auth-token'
});
larasopp.connect();
Larasopp provides full TypeScript support with generic types for channels, events, and users.
// Define your channel events structure
type ChannelsEvents = {
chat: {
message: { text: string; author: string; timestamp: number };
typing: { user: string };
userJoined: { user: string };
};
notifications: {
alert: { title: string; body: string; type: 'info' | 'warning' | 'error' };
update: { version: string };
};
};
// Define your user type
interface MyUser {
id: number;
name: string;
email: string;
avatar?: string;
}
// Create typed instance
const larasopp = new Larasopp<ChannelsEvents, MyUser>({
host: 'ws://127.0.0.1:3001',
token: 'your-token'
});
interface IConfig {
host: string; // WebSocket server URL
token?: string; // Authentication token
reviver?: (key: string, value: any) => any; // JSON reviver function
dataReviver?: { [key: string]: (value: any) => any }; // Per-key revivers
reconnect?: number; // Max reconnection attempts
reconnectDelay?: number; // Delay between reconnections (ms)
}
connect(token?: string)Connect to the WebSocket server.
larasopp.connect();
// or with token
larasopp.connect('new-token');
disconnect()Disconnect from the WebSocket server.
larasopp.disconnect();
setToken(token: string)Update authentication token.
larasopp.setToken('new-token');
subscribe<K>(channel: K): ListenerSubscribe to a channel. Returns a Listener instance for the channel.
// TypeScript will enforce that 'chat' exists in ChannelsEvents
const listener = larasopp.subscribe('chat');
unsubscribe<K>(channel: K)Unsubscribe from a channel.
larasopp.unsubscribe('chat');
countListeners<K>(channel: K): numberGet the number of listeners for a channel.
const count = larasopp.countListeners('chat');
listen<K>(event: K, callback, withCache?: boolean): thisListen to a specific event on the subscribed channel.
const listener = larasopp.subscribe('chat');
// TypeScript knows 'message' exists and its data type
listener.listen('message', (data) => {
// data is typed as { text: string; author: string; timestamp: number }
console.log(data.text, data.author);
});
// withCache: true will call callback immediately if cached data exists
listener.listen('typing', (data) => {
console.log(data.user, 'is typing');
}, true);
trigger<K, E>(channel: K, event: E, message, permission?, waitSubscribe?): voidTrigger an event on a channel.
Permission Levels:
'public' - Event will be sent to all channel subscribers AND to the API application'protected' - Event will be sent to all channel subscribers but NOT to the API application'private' - Event will be sent ONLY to the API application, not to channel subscribers// TypeScript ensures 'chat' channel and 'message' event exist
// and that the message matches the event type
// Public: sent to all subscribers and API
larasopp.trigger('chat', 'message', {
text: 'Hello World',
author: 'John Doe',
timestamp: Date.now()
}, 'public');
// Protected: sent to subscribers only, not to API
larasopp.trigger('chat', 'message', {
text: 'User message',
author: 'Jane Doe',
timestamp: Date.now()
}, 'protected');
// Private: sent to API only, not to subscribers
larasopp.trigger('chat', 'message', {
text: 'Admin notification',
author: 'System',
timestamp: Date.now()
}, 'private', true); // waitSubscribe: true waits for subscription
When triggering events, you can specify one of three permission levels:
| Permission | Channel Subscribers | API Application | Use Case |
|---|---|---|---|
'public' | ✅ Yes | ✅ Yes | Broadcast to everyone including server-side processing |
'protected' | ✅ Yes | ❌ No | Client-to-client communication without server handling |
'private' | ❌ No | ✅ Yes | Server-side only events (notifications, admin actions) |
Examples:
// Public: Broadcast message to all users and process on server
larasopp.trigger('chat', 'message', {
text: 'Hello everyone!',
author: 'John'
}, 'public');
// Protected: Send to users but don't trigger server-side handlers
larasopp.trigger('chat', 'typing', {
user: 'John'
}, 'protected');
// Private: Server-side only (e.g., admin notifications, system events)
larasopp.trigger('notifications', 'alert', {
title: 'System Maintenance',
body: 'Scheduled maintenance in 5 minutes'
}, 'private');
here(callback, withCache?: boolean): thisGet list of users currently in the channel.
listener.here((users) => {
// users is typed as MyUser[]
users.forEach(user => {
console.log(user.name, 'is here');
});
});
joining(callback, withCache?: boolean): thisListen for users joining the channel.
listener.joining((user) => {
// user is typed as MyUser
console.log(user.name, 'joined');
});
leaving(callback, withCache?: boolean): thisListen for users leaving the channel.
listener.leaving((user) => {
// user is typed as MyUser
console.log(user.name, 'left');
});
user(callback): voidGet current authenticated user.
larasopp.user((user) => {
// user is typed as MyUser
console.log('Current user:', user.name);
});
userRefresh(callback): voidRefresh current user data.
larasopp.userRefresh((user) => {
// user is typed as MyUser
console.log('Refreshed user:', user);
});
addListener(event, callback): EventListener | undefinedListen to socket-level events: 'open', 'close', 'error'.
larasopp.addListener('open', () => {
console.log('Connected to WebSocket');
});
larasopp.addListener('close', () => {
console.log('Disconnected from WebSocket');
});
larasopp.addListener('error', (error) => {
console.error('WebSocket error:', error);
});
remove()Remove all event listeners from a channel subscription.
const listener = larasopp.subscribe('chat');
listener.listen('message', handleMessage);
// Later, remove all listeners
listener.remove();
unsubscribe()Unsubscribe from the channel and remove all listeners.
listener.unsubscribe();
import Larasopp from 'larasopp';
// Define types
type AppChannels = {
chat: {
message: { text: string; author: string };
typing: { user: string };
};
notifications: {
alert: { title: string; body: string };
};
};
interface AppUser {
id: number;
name: string;
email: string;
}
// Create instance
const larasopp = new Larasopp<AppChannels, AppUser>({
host: 'ws://127.0.0.1:3001',
token: 'auth-token',
reconnect: 5,
reconnectDelay: 1000
});
// Connect
larasopp.connect();
// Listen to connection events
larasopp.addListener('open', () => {
console.log('Connected');
});
// Subscribe to channel
const chatListener = larasopp.subscribe('chat');
// Listen to events with full type safety
chatListener.listen('message', (data) => {
// TypeScript knows data structure
console.log(`${data.author}: ${data.text}`);
});
chatListener.listen('typing', (data) => {
console.log(`${data.user} is typing...`);
});
// Presence channel features
chatListener.here((users) => {
console.log('Users in channel:', users.map(u => u.name));
});
chatListener.joining((user) => {
console.log(`${user.name} joined`);
});
chatListener.leaving((user) => {
console.log(`${user.name} left`);
});
// Trigger events
larasopp.trigger('chat', 'message', {
text: 'Hello!',
author: 'John'
}, 'public');
// Get current user
larasopp.user((user) => {
console.log('Logged in as:', user.name);
});
// Cleanup
chatListener.remove();
larasopp.unsubscribe('chat');
larasopp.disconnect();
With TypeScript support, you get:
MIT
Sergey Serov
FAQs
Websocket client for laravel
We found that larasopp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.