
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
msb-http2bus
Advanced tools
An HTTP server providing endpoints for services exposed through the MSB bus.
An HTTP server providing endpoints for services exposed through the MSB bus.
$ npm install msb-http2bus
To run the server from the command line, globally install with option -g
.
Start a server with a static configuration file:
$ http2bus example/http2bus.json
Base configuration format, provided as either json or js:
{
channelMonitorEnabled: true, // Default: true
port: 8080, // Default: 0 (random port)
routes: [
{ /* ... */ },
{ /* ... */ }
]
}
(All standard MSB environment variables should be provided for broker configuration.)
Routes are loaded as an array of configuration objects, always specifying an http
section as well as either bus
or provider
section.
get
, post
, put
, head
. (Default: ['get']
)false
)For routing GET requests similar to /api/v1/example/abc123?depth=10
to example:topic
:
{
http: {
basePath: '/api/v1/examples',
path: '/:example-id',
methods: ['get']
},
bus: {
namespace: 'example:topic',
waitForResponses: 1
}
}
The payload placed on example:topic
would be similar to:
{
"method": "get",
"url": "/abc123",
"headers": {
"content-type": "application/json"
},
"params": {
"example-id": "abc123"
},
"query": {
"depth": "10"
}
}
See this normal responder example.
Headers provided in the responder payload are sent in the HTTP response. E.g, for a redirect:
response.writeHead(301, {
location: '/renamed-abc123'
})
If the location
header, is not fully qualified, i.e. without protocol and domain name, it will be rewritten relative to this base path specified in the route, in this case /api/v1/examples/renamed-abc123
.
To route all requests below /api/v1/remotes
using routes configurations provided by this routes agent.
{
http: {
basePath: '/api/v1/remotes'
},
provider: {
name: 'remotes-example-api'
}
}
The routes loaded by the corresponding Routes Agent will be published relative to the specified basePath
.
You can provide routes to http2bus servers from remote agents on the bus. An agent must be specified as a provider
in a route on the server. Note: an agent does not actually process any requests, it only publishes routes to the servers.
For example:
var http2bus = require('msb-http2bus')
var agent = http2bus.routesAgent.create({
name: 'remotes-example-api',
ttl: 3600000
})
var routes = [{
http: {
path: '/:example-id',
methods: ['get']
},
bus: {
namespace: 'example:topic',
waitForResponses: 1
}
}]
agent
.start()
.load(routes)
The configuration format for routes are the same as on the http2bus server. You can dynamically change routes to be reloaded on all relevant http2bus servers:
agent.load([])
(All standard MSB environment variables should be provided for broker configuration.)
MIT
FAQs
An HTTP server providing endpoints for services exposed through the MSB bus.
We found that msb-http2bus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.