
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A super-quick FFI for Node.js.
dyncall is used to make dynamic calls to native
functions. In order to avoid some cost of translating JavaScript values into raw
C types, a shared buffer is used for both arguments and return values. Writing
values to a buffer turns out to be quite a bit faster than unpacking them in
native code.
sbffi.getNativeFunction(pathToSharedLibrary, functionName, returnType, [argType1, argType2, ...])
All the arguments are strings. The types must be standard C types. See the Types section below for details. When functions take 64-bit types, the parameters must be passed as BigInts. 64-bit return values will also be BigInts.
// adder.c: some C library compiled to libadder.so
uint32_t add(uint32_t a, uint32_t b) {
return a + b;
}
// index.js
const { getNativeFunction } = require('sbffi');
const libPath = '/path/to/libadder.so';
const add = getNativeFunction(libPath, 'add', 'uint32_t', ['uint32_t', 'uint32_t']);
const result = add(23, 34);
// 57
To specify a callback, identify it in the arguments array as [cbReturnType, [cbArgTyp1, cbArgType2, ...]].
The following types are supported:
(u)int[8|16|32|64]_tbool(unsigned) char(unsigned) short(unsigned) int(unsigned) long(unsigned) long longfloatdoublesize_t128-bit types are not yet supported, and while this list may grow over time, for now other types can be used if they're aliases of the above types.
See the section below about pointers.
Pointers are currently assumed to be 64-bit, and can be passed to native
functions by specifying the type as pointer or referring to any other type
with an asterisk in the string, for example: uint8_t *.
You can put raw data into a Buffer, and then get a pointer to the start of that buffer with:
const bufferPointer = sbffi.getBufferPointer(buffer);
Arrays and strings must be passed as pointers.
For now, sbfffi doesn't have any built-in support for structs. That being
said, there are some helpful libraries like
shared-structs and
ref-napi (and its family of
modules). As long as you can build up a C struct into a Buffer, you can pass
pointers to them into C functions. Non-pointer struct arguments or return values
are not supported.
Using a non-release version of sbffi requires that
cmake is installed in order to compile the native
addon.
A simple benchmark can be run with npm run bench. This will test calling a
simple adding function from the test library using the following techniques:
ffi-napi: A successor to node-ffi compatible with modern versions of
Node.js.sbffi: This library.napi-addon: A very simple/normal Node.js addon using NAPI in C.napi-addon-sb: A NAPI addon using the same shared-buffer technique as
sbffi, but with a hard-coded function call, rather than a dynamic/FFI call.wasm: The adding function compiled to WebAssembly.js: Re-implementing the function in plain JavaScript.Each function will be called 100000 times, in 5 repetitions, timed with
console.time(). Here are the results on my machine (2019 Lenovo X1 Extreme,
running Ubuntu, Node v12):
ffi-napi: 1103.680ms
sbffi: 39.981ms
napi-addon: 8.214ms
napi-addon-sb: 6.795ms
wasm: 2.802ms
js: 2.644ms
---
ffi-napi: 1128.388ms
sbffi: 97.446ms
napi-addon: 3.631ms
napi-addon-sb: 3.308ms
wasm: 0.918ms
js: 0.045ms
---
ffi-napi: 1419.159ms
sbffi: 29.797ms
napi-addon: 3.946ms
napi-addon-sb: 3.717ms
wasm: 0.871ms
js: 0.090ms
---
ffi-napi: 1285.210ms
sbffi: 73.335ms
napi-addon: 4.618ms
napi-addon-sb: 3.651ms
wasm: 0.930ms
js: 0.096ms
---
ffi-napi: 772.013ms
sbffi: 29.467ms
napi-addon: 3.790ms
napi-addon-sb: 3.352ms
wasm: 0.847ms
js: 0.087ms
---
Of course, YMMV.
Please see CONTRIBUTING.md, CODE_OF_CONDUCT.md and TODO.md.
Please see LICENSE.txt.
FAQs
Dynamic C function calls from JS, powered by dyncall.
We found that sbffi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.