Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
A visual tool for wiring the Internet of Things.
Check out INSTALL for full instructions on getting started.
More documentation can be found here.
The Node-RED editor runs in the browser. We routinely develop and test using Chrome and Firefox. We have anecdotal evidence that it works in IE9.
We do not yet support mobile browsers, although that is high on our priority list.
Please raise any bug reports or feature requests on the project's issue tracker. Be sure to search the list to see if your issue has already been raised.
The plugin nature of Node-RED means anyone can create a new node to extend its capabilities.
We want to avoid duplication as that can lead to confusion. Many of our existing nodes offer a starting point of functionality. If they are missing features, we would rather extend them than add separate 'advanced' versions. But the key to that approach is getting the UX right to not lose the simplicity.
We are also going to be quite selective over what nodes are included in the main repository - enough to be useful, but not so many that new user is overwhelmed.
To contribute a new node, please raise a pull-request against the
node-red-nodes
repository.
Eventually, the nodes will be npm-installable, but we're not there yet. We'll also have some sort of registry of nodes to help with discoverability.
In order for us to accept pull-requests, the contributor must first complete a Contributor License Agreement (CLA). This clarifies the intellectual property license granted with any contribution. It is for your protection as a Contributor as well as the protection of IBM and its customers; it does not change your rights to use your own Contributions for any other purpose.
Once you have created a pull-request, we'll provide a link to the appropriate CLA document.
If you are an IBMer, please contact us directly as the contribution process is slightly different.
Node-RED is a creation of the IBM Emerging Technology Services team.
Copyright 2013 IBM Corp. under the Apache 2.0 license.
FAQs
Low-code programming for event-driven applications
We found that node-red demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.