
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
meshblu-server
Advanced tools
Meshblu is a cross-protocol IoT machine-to-machine instant messaging system. It is the core messaging system for Citrix's Octoblu IoT platform.
Supported Protocols: HTTP, Socket.io, Websocket, MQTT, CoAP, AMQP, and XMPP.
We have completely re-written Meshblu into many small components or micro-services. This Meshblu 1.0 repository is being preserved for historical reference.
All of the new Meshblu components are prefixed with meshblu-core
. See a list here.
Meshblu is dependent on node.js
, redis
, mongodb
, and either npm
or yarn
.
In order to run a barebones meshblu-core
cluster, you'll need the following repositories.
All meshblu-core
services and workers have a Dockerfile
.
A production Meshblu cluster will consist of many services and workers. We currently don't have documentation for running a complex cluster but we are working on it.
For development use, you can run the bundled barebones cluster:
git clone https://github.com/octoblu/meshblu
cd meshblu
npm install
node command.js --help
#!/bin/bash
# For development usage only
env \
PRIVATE_KEY_BASE64="..." \
PUBLIC_KEY_BASE64="..." \
PEPPER='some-random-string' \
MESHBLU_HTTP_PORT='3000' \
node command.js
See ./test-start.sh
#!/bin/bash
# For development usage only
node command.js \
--private-key-base64 '...' \
--public-key-base64 '...' \
--pepper 'some-other-random-string' \
--meshblu-http-port 3000
It is normal not see any debug output by default. If you want to see debug output, use the environment DEBUG=*
, or something more specific, like DEBUG=meshblu*
.
To verify that Meshblu 2.0 is alive and well, open http://localhost:3000/status in a web browser or open a new terminal tab and run:
curl http://localhost:3000/status
You should see Meshblu 2.0 respond with:
{"meshblu":"online"}
You can register a new IoT device by running:
curl -X POST http://localhost:3000/devices
You should see Meshblu 2.0 respond with an authentication UUID and Token as well as the device's security whitelist settings like this:
{ online: false,
discoverWhitelist: [ '*' ],
configureWhitelist: [ '*' ],
sendWhitelist: [ '*' ],
receiveWhitelist: [ '*' ],
uuid: 'b112c941-7973-4e2b-8dbe-b7bba27ae199',
meshblu:
{ createdAt: '2016-11-15T16:07:07.801Z',
hash: 'Dy5NlIlmygrrnhp0Cln+zb77nHlYdobc+HwbRVzWdPs=' },
_id: '582b32ab67899618f48c2e1b',
token: 'd5bcf1a57f4ccefa0ecdc672c7090e7949cc8244' }
Checkout our developer docs for more information on our HTTP REST API as well as documentation for all other protocol APIs, security whitelists and blacklists, connectors, data forwarders, and overall Meshblu architecture.
We have a convenient command line interface for simplifying the interaction with the Meshblu API.
# Install the meshblu cli utility
npm install --global meshblu-util
# Register a device
meshblu-util register -U http://localhost:3000 > meshblu.json
# Fetch the device
meshblu-util get
# Update the device
meshblu-util update -d '{"type": "some-device"}'
# Fetch the updated device
meshblu-util get
meshblu-core
componentsView it here
FAQs
A bundled version of meshblu-core
The npm package meshblu-server receives a total of 65 weekly downloads. As such, meshblu-server popularity was classified as not popular.
We found that meshblu-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.