
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
socket-pair
Advanced tools
Similar to stream-pair, but with sockets with real fds. A workaround for https://github.com/nodejs/node/issues/12716
A pair of coupled Unix sockets (or Windows pipes).
Similar to stream-pair, but with sockets with real fds and .setTimeout().
Originally a workaround for https://github.com/nodejs/node/issues/12716,
but still has some use relevant cases, particularly when building proxies.
Note: This workaround is necessary in node v6.11.1, but not necessary in node v8.2.1. I would assume it is also not necessary in later versions.
var socketPair = require('socket-pair');
var socket = socketPair.create(function (err, other) {
// socket as in `client = new net.Socket(); client.connect(...);`
// other as in `server.on('connection', function (conn) { ... })`
socket.write('123');
other.on('data', function (chunk) {
console.log(chunk.toString('utf8'));
});
socketPair.closeAll();
});
I named them client and connection, but their names really have no meaning.
You can call them a and b or other and one or red and blue. It makes no difference.
socketPair.create(cb) // creates or reuses a socket server
socketPair.closeAll() // closes the server and all sockets
FAQs
Similar to stream-pair, but with sockets with real fds. A workaround for https://github.com/nodejs/node/issues/12716
The npm package socket-pair receives a total of 227 weekly downloads. As such, socket-pair popularity was classified as not popular.
We found that socket-pair demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.