
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
laravel-echo
Advanced tools
In many modern web applications, WebSockets are used to implement realtime, live-updating user interfaces. When some data is updated on the server, a message is typically sent over a WebSocket connection to be handled by the client. This provides a more robust, efficient alternative to continually polling your application for changes.
To assist you in building these types of applications, Laravel makes it easy to "broadcast" your events over a WebSocket connection. Broadcasting your Laravel events allows you to share the same event names between your server-side code and your client-side JavaScript application.
Laravel Echo is a JavaScript library that makes it painless to subscribe to channels and listen for events broadcast by Laravel. You may install Echo via the NPM package manager.
Documentation for Echo can be found on the Laravel website.
Thank you for considering contributing to Echo! The contribution guide can be found in the Laravel documentation.
In order to ensure that the Laravel community is welcoming to all, please review and abide by the Code of Conduct.
Please review our security policy on how to report security vulnerabilities.
Laravel Echo is open-sourced software licensed under the MIT license.
Socket.IO is a JavaScript library for real-time web applications. It enables real-time, bidirectional and event-based communication. Compared to Laravel Echo, Socket.IO is more general-purpose and can be used with any backend, not just Laravel.
Pusher is a hosted service that makes it super-easy to add real-time data and functionality to web and mobile applications. The pusher-js library is the client-side component. Compared to Laravel Echo, Pusher provides a hosted solution and can be used with various backend technologies.
Ably is a platform that provides APIs to simplify and overcome the complex aspects of building and maintaining a real-time messaging system. The Ably JavaScript library is the client-side component. Compared to Laravel Echo, Ably offers a more comprehensive set of features and can be used with various backend technologies.
FAQs
Laravel Echo library for beautiful Pusher and Socket.IO integration
The npm package laravel-echo receives a total of 294,173 weekly downloads. As such, laravel-echo popularity was classified as popular.
We found that laravel-echo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.