
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Minimalist IPC/RPC protocol with message framing over any duplex stream. For example:
✅ Simple protocol: [length in hex] [JSON payload]
✅ Symmetric client/server capabilities
✅ Also supports unidirectional messages/events
✅ Works with any duplex stream (TCP, UNIX, etc.)
✅ Promise-based API
✅ Zero dependencies
✅ Just 143 lines of code (cloc src)
✅ Multiple asyncronous messages can be "on air" at the same time.
npm install linelink
import { createServer } from 'net';
import { LineLink } from 'linelink';
const server = createServer(socket => {
const link = new LineLink(socket);
link.register('ping', () => 'pong');
link.register('add', (a, b) => a + b);
link.on('myevent', (msg) => console.log(`received event: msg`));
}).listen('/tmp/app.sock');
import { connect } from 'net';
import { LineLink } from 'linelink';
const link = new LineLink(connect('/tmp/app.sock'));
const sum = await link.call('add', 2, 3); // 5
const pong = await link.call('ping'); // 'pong'
link.send('myevent', 'hello');
A message "line" is structured like this.
HHH JsonSerializedPayload
^ ^^
│ │└─ Payload
│ └── Space (0x20)
└───── Hexadecimal value of the length of the payload, not padded.
The JSON payload from client to server is in the form
{
method: [name of the "function" to call]
id: an incrementing number (per connection) to match server requests
args: the arguments specified by callee (JSON serialized)
}
The JSON payload from server to client:
{
id: negative number matching the client's request.
result: JSON serialized server reply
}
or { id: matching the request id error: error message string. }
Both sides can send payload with an id of 0 to send unidirectional events.
MIT
FAQs
Minimalist IPC/RPC protocol with line message framing over any duplex stream
We found that linelink demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.