
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A basic RPC wrapper around protobuf and websockets to facilitate writing web services and apps.
Features include:
This library is meant to be used in web pages running in a browser, to use this in a nodejs runtime see mprc-node.
mRPC's typescript integration is built around ts-proto generated interfaces and types.
First, add that to your project:
yarn add --dev ts-proto
and install the protobuf compiler so you have the protoc command. Then, you can use these to generate typescript bindings for use with mRPC:
protoc \
--plugin=protoc-gen-ts_proto=./node_modules/.bin/protoc-gen-ts_proto \
--ts_proto_out=./src/gen \
--ts_proto_opt=env=browser,outputServices=generic-definitions,outputServices=default \
--proto_path=../proto \
../proto/*.proto
Put that in a bash script for convenience to quickly update the typescript whenever you change the .proto files.
Once you have the generated ts-proto types, you can simply import them, import the
mrpc-web library, create an RpcClientChannel around a hostname or a
Socket object, and pass that into a ___ClientImpl's constructor:
import { RpcClientChannel } from "netrpc-web";
// Generated from an example helloworld.proto
import {
GreeterClientImpl,
Greeter,
} from "./gen/helloworld"
const channel = new RpcClientChannel({host: 'http://localhost:8080'});
const client = new GreeterClientImpl(channel);
...
const result = await client.SayHello({name: "Alice"});
You can also write services in the Browser - simply wrap a socket that was previously connected and the Server can now act as a client to the webpage.
See https://github.com/maunvz/mRPC/tree/main/samples for a full example of a server/client nodejs command line.
FAQs
An RPC wrapper around profobufs that uses websockets and http requests (web)
We found that mrpc-web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.