
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
MCom is an attempt to write a single, shared, two-way (read/write) protocol for communicating between (embedded) hardware. This is a simple Node.JS port of the more general protocol written in C, check https://bitbucket.org/jouweneel/mcom/ for more details.
Made some updates on Mqtt; both client and server now also have a shared 'broadcast' channel which allows the server to send messages to all clients at once, which also enables auto-reconnect after only restarting the server or the client. There's some examples in the 'examples' folder. In more exciting news, i've finished the first version of mcom-lua, which can be ran on the awesome Node-MCU's; the project can be found at https://github.com/jouweneel/mcom-lua! This includes a lot more than just the mcom script (in fact, full wi-fi, mqtt and ws2812 startup with my custom settings, but let's say this is including a thorough example :P). If you're interested, go check it out!
After finding the incredibly handy NodeMCU socs and nog being happy with their performance when controlling ws2812 LED strips when using simple TCP connections, I came across a protocol called MQTT, which should be tailor-made for these kinds of IOT-like applications.
As such, I decided to pull this project out of the slops again, update it with some small changes I had made over time on my Pi, and add a new MQTT communicator.
It consists of a MqttServer and MqttClient - but actually, they are both just clients connected to one central mqtt message broker (check mosquitto.org for reference). The difference is that the Server is able to manage incoming client connections, sending directed data to one of them, while the Clients are just dumbed-down versions that can only receive and transmit data.
I didn't really have need of the client, since the NodeMCU platform isn't capable of running Node.JS with the 'default' LUA-based firmware, but added it still, if only for testing purposes. This does mean that I will be adding a LUA-based implementation of mcom tho :) - will update the README after that's up and running (probably involving some bugfixes in this library as well xD).
There's a bit more documentation on how to set stuff up in the lib/Mqtt.js file.
As usual:
npm install mcom
The basic idea is that MCom sends byte-arrays representing messages. The first byte is a command byte, followed by a certain amount of data bytes.
To define a command, use
MCom.bind(int command, int data_length [, function callback(result));
function setRGB(result) {
var r = result.data[0], g = result.data[1], b = result.data[2];
ledStrip.setColor(r, g, b); // Dummy function
}
var colorCmd = 0x00;
// Send example (no callback needed)
MCom.bind(colorCmd, 3);
// On receive example (with callback)
MCom.bind(colorCmd, 3, setRGB);
This binds the command integer to a fixed data length for that command, and a callback function that is automatically called if that command is received
Currently, there's 3 communicators available: RS232 (serial COM-port), TCP (server and client) and MQTT (server and client).
Code example: const CMD_TEST = 0x01, mcom = require('mcom');
function handler(packet) {
// packet { cmd: <bound command>, len: <bound length>, data: <Buffer> }
console.log('Got packet', packet.data.toString());
}
// Binds for both transmitter and receiver, since they are in the same file here
// This is not a typical use-case though
mcom.bind(CMD_TEST, 8, handler);
var serial = new mcom.Serial('/dev/ttyUSB0', 115200, true, function(err) {
// Called when connected
mcom.send(serial, CMD_TEST, 'testing!');
});
var tcpServer = new mcom.TCPserver(2222, true, function(status, socket) {
// Will call back with a TCPclient instance that is mcom-compatible
mcom.send(socket, CMD_TEST, 'testing!');
});
var tcpClient = new mcom.TCPclient(2222, function(status) {
mcom.get(tcpClient); // Starts listening. Calls 'handler' when CMD_TEST is received
});
var mqttServer = new mcom.MqttServer({
host: 'localhost',
port: 1883,
id: 'my_server', // Optional, random uuid otherwise
protocol: 'mqtt' // Optional, mqtt is default, check npmjs.org->mqtt for options
}, (status, socket) => {
if (status === 'client_connected') {
let mqttSocket = socket;
mcom.send(mqttSocket, CMD_TEST, 'testing!')
}
});
var mqttClient = new mcom.MqttClient({
host: 'localhost',
port: 1883
}, (status) => {
mcom.get(mqttClient); // Starts listening. Calls 'handler' when CMD_TEST is received
});
FAQs
NodeJS version of the MCom protocol
We found that mcom demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.