
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Yet another RPC client and server, with minimalistic publish/subscribe implementation.
Server
Client
npm install pinary
const PinaryServer = require('pinary').server;
const server = new PinaryServer();
// with options (see below)
// const server = new PinaryServer({port:64000});
| Option | Default | Notes |
|---|---|---|
| useTLS | false | Use clear TCP or TLS |
| useZLIB | false | Use ZLIB compression |
| maxClients (1) | 10 | Maximum number of simultaneous TCP connections |
| timeoutData | 1000 | Delay before socket close if no data sent, in milliseconds |
| host | 0.0.0.0 | Listening IP/host |
| port | 65000 for TCP, 65001 for TLS | Listening port |
| key | null | TLS: private key |
| cert | null | TLS: public key |
| ca | null | TLS: certificate authority (string of array of string) |
| secureProtocol | TLSv1_2_method | TLS: cipher |
| rejectUnauthorized | false | TLS: allow self signed certificates, or not |
(1) under the hood, a "client" is in fact 2 sockets, one for writing, one for reading.
const PinaryClient = require('pinary').client;
const client = new PinaryClient(); // auto connect
// with a TCP url
// const client = new PinaryClient('tcp://localhost:64000',[options]);
// with a TLS url
// const client = new PinaryClient('tls://localhost:64000',[options]);
| Option | Default | Note |
|---|---|---|
| reconnectInterval | 500 | milliseconds |
| queueSize | 100 | store rpc calls limit when not connected/disconnected |
// using callback
client.rpc('myMethod', (err, result) => {
if (err) throw err;
console.log(result);
});
// using async/await
async function letsgo() {
let result;
try {
result = await client.rpcPromise('myMethod');
} catch(e) {
// something wrong
}
console.log(result);
}
Note: if not yet connected or while the client is trying to reconnect, RPC calls are stored in a queue and played when client is connected.
| event name | arguments | Notes |
|---|---|---|
| connected | retryCount | if retryCount = 0, first connection, else reconnection |
| disconnected | ||
| error | Error |
const Server = require('pinary').server;
const Client = require('pinary').client;
const server = new Server();
const client1 = new Client();
const client2 = new Client();
const channel = '/myChannel';
server.start();
client1.subscribe('/bla', (data) => {
console.log(data);
process.exit();
});
client2.publish('/bla', { foo:'bar' });
const Server = require('pinary').server;
const Client = require('pinary').client;
const server = new Server();
const client = new Client();
const channel = '/myChannel';
server.start();
client.subscribe(channel, (data) => {
console.log(data);
process.exit();
});
server.publish(channel, { foo:'bar' });
The actual implementation is minimalistic:
FAQs
RPC other TCP/TLS and PubSub
We found that pinary demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.