
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
node-websockify-js
Advanced tools
Original version of websockify-js you can found here.
websockify was formerly named wsproxy and was part of the noVNC project.
At the most basic level, websockify just translates WebSockets traffic to normal socket traffic. Websockify accepts the WebSockets handshake, parses it, and then begins forwarding traffic between the client and the target in both directions.
To use node-websockify:
npm install node-websockify
const Websockify = require('.');
(async () => {
//Create websockify instance
let wsockify = new Websockify(
{
source: 'localhost:5901', //WebSocket server binding address
target: 'localhost:5900', //Proxying TCP port
//logEnabled: false, //Disable logging
}
);
//Start websockify instance
await wsockify.start();
//Some stuff...
//Stops websockify instance
await wsockify.stop();
})();
Also supports multiple websockify by using shared webserver:
const Websockify = require('.');
const http = require('http');
//Shared web server
let webServer = http.createServer();
webServer.listen(5901);
(async () => {
let wsockify1 = new Websockify(
{
webServer,
target: 'localhost:5900',
path: '/socket1',
}
);
let wsockify2 = new Websockify(
{
webServer,
target: 'localhost:5900',
path: '/socket2',
}
);
await wsockify1.start();
await wsockify2.start();
})();
Bugs and feature requests can be submitted via github issues.
FAQs
node-websockify is NodeJS module version of websockify-js project
We found that node-websockify-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.