Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Javascript/Node.js drivers and protocol implementation for Lovense Products (Max, Nora, Lush, Hush, etc...)
lovesense is a library for controlling Lovense sex toys, such as the Max, Nora, and Lush. The library allows users to control all aspects of the toy (vibration/rotation/inflation, depending on the toy), as well as retrieving information like device type, status, battery level, and accelerometer readings.
The library is currently available in the following languages:
If you need an implementation in a language not currently supported by lovesense, please file an issue on the github tracker of the relevant project.
Please note that this project has no direct relation to the Lovense company. These drivers have been developed/supported by the open source community. Lovense has had no direct participation in this project and most likely will not be able to answer questions or provide support for any of the Lovesense drivers.
If you require commercial support for programming for Lovense products, it is recommended you go through the Official Lovense Developer Program.
lovesense-js requires the serialport library if you want to actually connect via serial. This dependency should be installed via npm.
However, the library is built to abstract the raw box protocols from the communication medium, so it can pass packets for each box over whatever medium you like. For instance, you could create a network class that talks to a daemon that communicates with a serial port, if needed.
Lovense toys connect via bluetooth, and then use the Serial Port Profile (SPP) to communicate with the host. This means that the toys are exposed as either COM Ports (windows) or tty devices (posix/bsd/etc).
The following is the known command table for all toys. Anything send or received over the serial port is in quotes to denote communication, but should not be sent using quotes if you are implementing your own version of this protocol. Commands with ":x" mean that the x should be replaced with a number, the range of which is mentioned in the description.
Command | Description | Expected Return |
---|---|---|
"DeviceType;" | Returns toy type (A: Lush, B: Max, C: Nora), Firmware version, and bluetooth MAC address, as a colon delimited list | String, e.g. "C:11:0082059AD3BD;" |
"Battery;" | Returns battery level of toy | Number, e.g. "85;" meaning 85% battery left |
"PowerOff;" | Powers the device off | "OK;" |
"Status:1;" | Shows device status. 2 is "normal" | "2;" |
"StartMove:1;" | Starts accelerometer data stream. | String, that always starts with 'G', followed by 3 16-bit little-endian numbers e.g. "GEF008312ED00" |
"StopMove:1;" | Stops accelerometer data stream | "OK;" |
"RotateChange;" | Changes the direction of rotation for the stimulator on the Nora toy. | "OK;" |
"Vibrate:x;" | Sets vibration level for toy. Range seems to be 0-20. | "OK;" |
"Rotate:x;" | Sets rotation speed for Nora toy. Range seems to be 0-20. | "OK;" |
"Air:Level:x;" | Sets absolute air level for Max toy. Range seems to be 0-5; | "OK;" |
"Air:In:x;" | Sets relative inflation level, i.e. if currently inflation level is 3, and "Air:In:1" is sent, will inflate to 4 | "OK;" |
"Air:Out:x;" | Sets relative deflation level, i.e. if currently inflation level is 3, and "Air:Out:1" is sent, will inflate to 2 | "OK;" |
Thanks to PenTest Partners for doing most of the heavy lifting and documenting it in their blog. This library is mostly just an implementation of the information found in that post.
tl;dr: BSD 3-Clause License
Copyright (c) 2016, Metafetish Project All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
THIS SOFTWARE IS PROVIDED BY The Authors ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL The Authors BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
FAQs
Javascript/Node.js drivers and protocol implementation for Lovense Products (Max, Nora, Lush, Hush, etc...)
We found that lovesense demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.