
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
socket.io-parser
Advanced tools
This repository contains the protocol specification and JavaScript parser for the Socket.IO protocol.
Current protocol revision: 1.
Encodes a Packet object as a string.
Returns a Packet object for the given string. If a parsing error
occurs the returned packet is an error object.
Array of packet type keys.
Each packet is represented as a vanilla Object with a nsp key that
indicates what namespace it belongs to (see "Multiplexing") and a
type key that can be one of the following:
Packet#CONNECT (0)Packet#DISCONNECT (1)Packet#EVENT (2)Packet#ACK (3)Packet#ERROR (4)data (Array) a list of arguments, the first of which is the event
name. Arguments can contain any type of field that can result of
JSON decoding, including objects and arrays of arbitrary size.
id (Number) if the id identifier is present, it indicates that the
server wishes to be acknowledged of the reception of this event.
data (Array) see EVENT data.id (Number) see EVENT id.data (Mixed) error dataThe socket.io protocol can be delivered over a variety of transports. socket.io-client is the implementation of the protocol for the browser and Node.JS over engine.io-client.
socket.io is the server implementation of the protocol over engine.io.
Socket.IO has built-in multiplexing support, which means that each packet
always belongs to a given namespace, identified by a path string (like
/this). The corresponding key in the Packet object is nsp.
When the socket.io transport connection is established, a connection
attempt to the / namespace is assumed (ie: the server behaves as if
the client had sent a CONNECT packet to the / namespace).
In order to support multiplexing of multiple sockets under
the same transport, additional CONNECT packets can be sent by the
client to arbitrary namespace URIs (eg: /another).
When the server responds with a CONNECT packet to the corresponding
namespace, the multiplexed socket is considered connected.
Alternatively, the server can respond with an ERROR packet to indicate
a multiplexed socket connection error, such as authentication errors.
The associated error payload varies according to each error, and can
be user-defined.
After a CONNECT packet is received by the server for a given nsp,
the client can then send and receive EVENT packets. If any of the
parties receives an EVENT packet with an id field, an ACK packet is
expected to confirm the reception of said packet.
MIT
This package is part of the Engine.IO library, which is a lower-level component of the Socket.IO framework. It provides similar encoding and decoding functionalities for the Engine.IO protocol, which is a bit more focused on the transport layer compared to the higher-level abstraction provided by socket.io-parser.
While not a direct alternative to socket.io-parser, the 'ws' package is a popular WebSocket library for Node.js that allows for sending and receiving data over WebSockets. It handles the WebSocket protocol directly, without the additional features and abstractions that Socket.IO provides.
json-socket is a wrapper around the Node.js net library that adds a layer for seamless JSON message sending and receiving. It's similar to socket.io-parser in that it deals with message serialization and deserialization, but it's tailored for use with raw TCP sockets rather than the Socket.IO protocol.
FAQs
socket.io protocol parser
The npm package socket.io-parser receives a total of 10,876,885 weekly downloads. As such, socket.io-parser popularity was classified as popular.
We found that socket.io-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.