
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
signalk-ntfy
Advanced tools
Reliable push notifications and bidirectional communication for your boat: from automatic SignalK alerts to interactive mobile controls.
This plugin offers two levels of integration between your SignalK server and ntfy:
Basic Mode (ready to use):
Automatically sends SignalK alerts (alarm, warn, etc.) to an ntfy topic of your choice.
You only need to:
Advanced Mode (requires additional setup):
Enables bidirectional communication:
This second level does not include processing logic: the plugin acts only as a bridge. You decide what to do with those messages (via Node-RED, scripts, another plugin, etc.).
ntfy is a lightweight, secure, self-hostable, and dependency-free alternative to services like Telegram or Pushover:
| Feature | ntfy | Common Alternatives |
|---|---|---|
| Self-hostable | Yes (100% offline possible) | Usually not |
| No account required | Use topics like “passwords” | Registration required |
| Bidirectional | WebSockets + interactive buttons | Limited or non-native |
| Open Source | Apache 2.0 / GPLv2 | Closed or partial |
| Network-friendly | Small messages, low bandwidth | Often heavier |
Ideal for marine environments: works on local networks, doesn’t rely on external services, and uses minimal resources.
The plugin is designed for all skill levels:
Perfect for receiving SignalK alerts (alarm, warn, etc.) on your mobile device with minimal setup.
You only need:
Example use case:
“Engine overheating” → Instant push notification on your phone.
This is the plugin’s core functionality.
Send commands from your phone (e.g., restart a server or turn off lights) and receive confirmations or responses in SignalK.
Key features:
Example use case:
Notification: “Reboot RPi4?” → User taps "OK" -> Command executed via SSH -> Confirmation received in SignalK.
Ideal for embedded control systems where secure, app-free interaction is essential.
To receive push notifications on your phone, you’ll need the official ntfy app:
The app runs in the background, listens to your topics, and delivers instant, reliable notifications — even when your phone is idle. No account needed.
If you use the public ntfy.sh service, please respect its free-tier limits:
The public server runs in open mode (auth-default-access: read-write for everyone), meaning anyone who knows your topic name can both read and publish to it, even without a token.
The only effective protection on ntfy.sh is to:
If you need true topic privacy, authenticated publishing, or reserved names:
For typical boating scenarios, you don’t need enterprise-grade security — but you do need sensible naming:
Important: The commandsTopic is the most sensitive — it can trigger actions on your boat (reboots, power switches, etc.). Always use a long, random name and combine it with a token if using self-host.
For most boaters, yes:
If you need full ACLs, authentication, or TLS isolation, self-host ntfy on your Raspberry Pi or PC and disable public access.
Never use localhost in your server URL if you interact from mobile devices.
Your phone interprets localhost as itself — not your SignalK server.
See the plugin’s built-in documentation for:
The plugin creates the following SignalK data paths and REST API endpoints to enable full integration:
communications.ntfy.settings.activeServer (always available)
String indicating the ID of the currently active ntfy server (e.g., "local" or "ntfysh"). Updated on startup and every 30 seconds.
communications.ntfy.responses (advanced mode only)
Received ntfy interactive button responses (e.g., user taps "Ok" or "Cancel") appear here as SignalK deltas.
communications.ntfy.commands (advanced mode only)
Custom commands sent via ntfy (e.g., "action:reboot,value:true") are published here for consumption by Node-RED, other plugins, or automation logic.
These paths allow seamless integration with SignalK-compatible tools without polling or external dependencies.
The plugin exposes the following endpoints under SignalK’s plugin router (/plugins/signalk-ntfy):
Note: Responses from interactive buttons will always be published to the configured responsesTopic (communications.ntfy.responses), regardless of the topic used in the original message.
Example request:
{
"title": "Cabin Lights Control",
"message": "Turn off cabin lights?",
"topic": "boat_alerts",
"actions": [
{
"action": "broadcast",
"label": "Yes",
"message": "action:lights_off,value:true",
"actionId": "cabin_lights_123"
},
{
"action": "broadcast",
"label": "No",
"message": "action:lights_off,value:false",
"actionId": "cabin_lights_123"
}
]
}
{
"status": "active",
"plugin": "signalk-ntfy",
"configured": true,
"ntfyUrl": "https://ntfy.sh",
"defaultTopic": "boat_alerts",
"timestamp": "2025-11-04T12:00:00.000Z"
}
{
"serverId": "local"
}
Example successful response:
{
"status": "updated",
"activeServer": "local",
"persistent": true,
"listenersRestarted": true,
"timestamp": "2025-11-04T12:00:00.000Z"
}
For full request/response schemas and validation rules, see the included openApi.json file.
License: Apache-2.0
Special thanks to an anonymous technical collaborator whose guidance significantly improved the design and robustness of this plugin.
Thanks to the SignalK community and ntfy.sh for building reliable, open tools.
This plugin is not affiliated with ntfy.sh or SignalK. Use at your own risk and in compliance with services.
Example: Notification with confirmation
{
"title": "Cabin Lights Control",
"message": "Turn off cabin lights?",
"actions": [
{
"action": "broadcast","label": "Yes",
"message": "action:lights_off,value:true",
"actionId": "cabin_lights_123"
},
{
"action": "broadcast",
"label": "No",
"message": "action:lights_off,value:false",
"actionId": "cabin_lights_123"
}
]
}
FAQs
Send SignalK notifications to ntfy.sh or self-hosted ntfy servers
We found that signalk-ntfy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.