
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
sand-socket
Advanced tools
Sand is a very simple and lightweight implementation of the core node TCP socket, adding some usefull features like client management, packet separation, handshake and event oriented clients like socket.io.
$ npm i -s sand-socket
The usage is very simple and inspired on socket.io, but you are going to use write instead of emit.
const SandSocket = require('sand-socket');
const server = new SandSocket();
// Listening for a new client connection
server.on('connected', async (client) => {
// Writing a chat message to the client
client.write('chat', JSON.stringify({
text: "Feel free to write anything you want.",
user: 'System'
}));
// Listening to a chat message from client
client.on('chat', message => {
// Sendin the message to all the other clients connected
socket.writeToAll("chat", message);
});
// Listening for this client disconnection
client.on('disconnected', message => {
console.log("Client " + client.id + " disconnected.");
});
});
// Starting server on the port 3000
server.listen(3000);
You can set options to the node server setting the serverOptions parameter in the Sand server options when creating it.
const SandSocket = require('sand-socket');
const options = {};
const server = new SandSocket({ serverOptions: options });
Sand packets are text-oriented, by default it just sends a string to the client using "\n" as the delimiter between packets, and "#e#" as the delimiter between event name and message. If you prefer, you can set any other delimiter by passing it to the socket constructor.
const SandSocket = require('sand-socket');
const packetDelimiter = "packetEndsHere";
const eventDelimiter = "eventNameEndsHere";
const server = new SandSocket(null, packetDelimiter, eventDelimiter);
Sand socket supports node core TLS implementation.
const fs = require("fs");
const SandSocket = require('sand-socket');
const options = {
key: fs.readFileSync("./path-to-key"),
cert: fs.readFileSync("./path-to-cert")
};
const server = new SandSocket({ tls: true, serverOptions: options });
In case you want to see what is happening behind the scenes, just activate the verbose log.
const SandSocket = require('sand-socket');
const server = new SandSocket();
server.verboseLog = true;
The performance was not enough tested yet, and as long as it is a TCP socket and is text-based, it may not be the best option for an application that requires a lot of packets per second, like an action game.
These are what I'm planning to implement in the short-term, in case you have a suggestion feel free to contact me or open an issue :)
FAQs
Sand is a lightweight implementation of net tcp socket.
The npm package sand-socket receives a total of 2 weekly downloads. As such, sand-socket popularity was classified as not popular.
We found that sand-socket demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.