
Security News
gem.coop Tests Dependency Cooldowns as Package Ecosystems Move to Slow Down Attacks
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.
minecraft-protocol
Advanced tools
Parse and serialize minecraft packets, plus authentication and encryption.
Parse and serialize minecraft packets, plus authentication and encryption.
Want to contribute on something important for PrismarineJS ? go to https://github.com/PrismarineJS/mineflayer/wiki/Big-Prismarine-projects
node-minecraft-protocol is pluggable.
npm install minecraft-protocol
const mc = require('minecraft-protocol');
const client = mc.createClient({
host: "localhost", // optional
port: 25565, // set if you need a port that isn't 25565
username: 'Bot', // username to join as if auth is `offline`, else a unique identifier for this account. Switch if you want to change accounts
// version: false, // only set if you need a specific version or snapshot (ie: "1.8.9" or "1.16.5"), otherwise it's set automatically
// password: '12345678' // set if you want to use password-based auth (may be unreliable). If specified, the `username` must be an email
});
client.on('playerChat', function (ev) {
// Listen for chat messages and echo them back.
const content = ev.formattedMessage
? JSON.parse(ev.formattedMessage)
: ev.unsignedChat
? JSON.parse(ev.unsignedContent)
: ev.plainMessage
const jsonMsg = JSON.parse(packet.message)
if (ev.senderName === client.username) return
client.chat(JSON.stringify(content))
});
Set auth to offline if the server is in offline mode. If auth is set to microsoft, you will be prompted to login to microsoft.com with a code in your browser. After signing in on your browser, the client will automatically obtain and cache authentication tokens (under your specified username) so you don't have to sign-in again.
To switch the account, update the supplied username. By default, cached tokens will be stored in your user's .minecraft folder, or if profilesFolder is specified, they'll instead be stored there. For more information on bot options see the API doc.
Note: SRV records will only be looked up if the port is unspecified or set to 25565 and if the host is a valid non-local domain name.
Example to connect to a Realm that the authenticating account is owner of or has been invited to:
const mc = require('minecraft-protocol');
const client = mc.createClient({
realms: {
pickRealm: (realms) => realms[0] // Function which recieves an array of joined/owned Realms and must return a single Realm. Can be async
},
auth: 'microsoft'
})
For a more up to date example, see examples/server/server.js.
const mc = require('minecraft-protocol')
const nbt = require('prismarine-nbt')
const server = mc.createServer({
'online-mode': true, // optional
encryption: true, // optional
host: '0.0.0.0', // optional
port: 25565, // optional
version: '1.18'
})
const mcData = require('minecraft-data')(server.version)
function chatText (text) {
return mcData.supportFeature('chatPacketsUseNbtComponents')
? nbt.comp({ text: nbt.string(text) })
: JSON.stringify({ text })
}
server.on('playerJoin', function(client) {
const loginPacket = mcData.loginPacket
client.write('login', {
...loginPacket,
enforceSecureChat: false,
entityId: client.id,
hashedSeed: [0, 0],
maxPlayers: server.maxPlayers,
viewDistance: 10,
reducedDebugInfo: false,
enableRespawnScreen: true,
isDebug: false,
isFlat: false
})
client.write('position', {
x: 0,
y: 255,
z: 0,
yaw: 0,
pitch: 0,
flags: 0x00
})
const message = {
translate: 'chat.type.announcement',
with: [
'Server',
'Hello, world!'
]
}
if (mcData.supportFeature('signedChat')) {
client.write('player_chat', {
plainMessage: message,
signedChatContent: '',
unsignedChatContent: chatText(message),
type: mcData.supportFeature('chatTypeIsHolder') ? { chatType: 1 } : 0,
senderUuid: 'd3527a0b-bc03-45d5-a878-2aafdd8c8a43', // random
senderName: JSON.stringify({ text: 'me' }),
senderTeam: undefined,
timestamp: Date.now(),
salt: 0n,
signature: mcData.supportFeature('useChatSessions') ? undefined : Buffer.alloc(0),
previousMessages: [],
filterType: 0,
networkName: JSON.stringify({ text: 'me' })
})
} else {
client.write('chat', { message: JSON.stringify({ text: message }), position: 0, sender: 'me' })
}
})
java executable in PATH.MC_SERVER_JAR_DIR=some/path/to/store/minecraft/server/ MC_USERNAME=email@example.com MC_PASSWORD=password npm testYou can enable some protocol debugging output using DEBUG environment variable:
DEBUG="minecraft-protocol" node [...]
On Windows:
set DEBUG=minecraft-protocol
node your_script.js
Please read https://github.com/PrismarineJS/prismarine-contribute
See history
FAQs
Parse and serialize minecraft packets, plus authentication and encryption.
The npm package minecraft-protocol receives a total of 18,413 weekly downloads. As such, minecraft-protocol popularity was classified as popular.
We found that minecraft-protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.