Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
serialport-io
Advanced tools
A virtual node-serialport implementation that uses socket.io as the transport.
First you need git and node.js to clone this repo and install dependencies:
git clone https://github.com/elin-moco/serialport-io
cd serialport-io
npm install
Secondly, you'll need an Arduino board with StandardFirmata, put an LED on pin 7, connect Arduino to you computer via USB cable.
To use socket.io to send/receive data to the device with firmata or Johnny Five, run below gulp tasks to browserify them like:
gulp build
You'll find the browserified scripts in build
folder
node server.js
Will get you started, server is listening on port 3000 by default. This server pass data bewteen browser and node.js to control your device, make sure your server is running before running your code in browser or node.js.
Include Johnny Five bundle script in your html file:
<script src="http://localhost:3000/socket.io/socket.io.js"></script>
<script type="text/javascript" src="j5-bundle.js"></script>
var SocketIoSerialPort = require('serialport-io').SerialPort;
var five = require('johnny-five');
Then use it directly in your script:
var socket = io('ws://localhost:3000');
var sp = new SocketIoSerialPort({
client: socket,
device: { //put your device channel/address here
channel: 'serial',
address: '/dev/cu.usbmodem1411'
}
});
sp.connect().then(function() {
console.log('SocketIoSerialPort.open');
// have a ready serial port, do something with it:
var board = new five.Board({port: sp, repl: false});
board.on('ready', function() {
console.log('actually connected to an arduino!');
var led = new five.Led(7);
led.blink();
});
});
And you should see the LED blinks once you have the webapp(page) opened. Or you can open example/browser-j5.html directly to see live demo.
Include the firmata bundle script in your html file:
<script src="http://localhost:3000/socket.io/socket.io.js"></script>
<script type="text/javascript" src="firmata-bundle.js"></script>
To use with node.js, you'll need these two require statements:
var SocketIoSerialPort = require('serialport-io').SerialPort;
var firmata = require('firmata');
Then use it directly in your script:
var socket = io('ws://localhost:3000');
var sp = new SocketIoSerialPort({
client: socket,
device: { //put your device channel/address here
channel: 'serial',
address: '/dev/cu.usbmodem1411'
}
});
sp.connect().then(function() {
console.log('SocketIoSerialPort.open');
// have a ready serial port, do something with it:
var board = new firmata.Board(sp);
board.on('ready', function() {
console.log('actually connected to an arduino!');
board.digitalWrite(7, 1);
});
});
And you should see the LED on once you have the webapp(page) opened. Or you can open example/browser-firmata.html directly to see live demo.
If you don't know which USB port connects to your Arduino,
you can find it in Arduino IDE under 'Tools' menu.
The port pattern on different platform will be:
OSX: /dev/tty.usbmodem****
Linux: /dev/ttyUSB*
Windows: COM*
See ble-serialport if you are interested in running j5/firmata on Firefox OS via BLE.
FAQs
Virtual serial device over socket.io
We found that serialport-io demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.