
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
localchat-byr
Advanced tools
LocalChat by R - A CLI tool for peer-to-peer chat over local network with authentication, chatrooms, and built-in Google Sheets logging
A beautiful peer-to-peer chat application that runs in your terminal. Chat with anyone on the same WiFi network with hidden Google Sheets logging!
# Clone or download this repository
cd node-cli-chat
# Install dependencies (already done!)
npm install
# Start chatting immediately
npm start
That's it! The app works out of the box.
Open two terminals:
# Terminal 1
npm start
# Terminal 2
USERNAME=TestUser2 PORT=3001 npm start
Wait a few seconds and you'll see each other! 🎉
┌─────────────┐ ┌─────────────┐
│ User 1 │ │ User 2 │
│ │ │ │
│ 1. Starts │ │ 1. Starts │
│ app │ │ app │
│ │ │ │
│ 2. Discovers├────── mDNS ───────►│ 2. Appears │
│ users │◄─── Broadcast ─────┤ in list │
│ │ │ │
│ 3. Selects │ │ │
│ User 2 │ │ │
│ │ │ │
│ 4. Chat ────┼──── Socket.io ────►│ 4. Chat │
│ │◄──── P2P ──────────┤ │
│ │ │ │
└──────┬──────┘ └──────┬──────┘
│ │
│ (Hidden Feature) │
└────────► Google Sheets ◄─────────┘
Silent Logging
🌐 P2P Chat over Local Network
📍 Your IP: 192.168.1.100
🔍 Discovering users on network...
👥 Available Users
┌────────────────────────────────┬────────────────────┐
│ Name │ IP Address │
├────────────────────────────────┼────────────────────┤
│ John's MacBook │ 192.168.1.101 │
│ Sarah's Laptop │ 192.168.1.102 │
│ Office Desktop │ 192.168.1.103 │
└────────────────────────────────┴────────────────────┘
? Select a user to chat with:
╭───────────────────────────────────────────╮
│ │
│ 💬 Chatting with John's MacBook │
│ │
╰───────────────────────────────────────────╯
Type your message and press Enter. Type "back" to return to user list.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
John's MacBook: Hey! How are you?
You: Great! Working on a cool project.
John's MacBook: Nice! What is it?
You: A local network chat app!
The app has a secret superpower: it silently logs all messages to Google Sheets!
Every message is saved to your Google Sheet:
| Timestamp | From | To | Message |
|---|---|---|---|
| 2025-10-01 10:30:15 | Ramya | John | Hey! How are you? |
| 2025-10-01 10:30:18 | John | Ramya | Great! And you? |
See SETUP.md for complete instructions.
Quick version:
credentials.json.envEdit .env file:
# Your display name
USERNAME=YourName
# Port for server (change if 3000 is taken)
PORT=3000
# Google Sheet ID (optional)
SPREADSHEET_ID=your_spreadsheet_id_here
node-cli-chat/
├── index.js # Entry point
├── package.json # Dependencies
├── .env # Configuration
├── src/
│ ├── app.js # Main application
│ ├── network.js # Network discovery
│ ├── chat.js # Chat logic
│ ├── ui.js # CLI interface
│ └── sheets.js # Google Sheets (silent)
├── QUICKSTART.md # Quick start guide
├── SETUP.md # Detailed setup
└── TESTING.md # Testing guide
⚠️ Important Security Notes:
Recommended for: Home networks, office networks, trusted environments
PORT=3001 npm start
credentials.json existsSPREADSHEET_ID in .envISC License - Feel free to use and modify!
Contributions welcome! Feel free to:
Built with ❤️ using:
Need help? Check these files:
Ready to chat?
npm start
Made with ❤️ for local communication
⭐ Star this repo if you find it useful!
FAQs
LocalChat by R - A CLI tool for peer-to-peer chat over local network with authentication, chatrooms, and built-in Google Sheets logging
We found that localchat-byr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.