Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Socket based JSON Message for NodeJS
Alternative to exchange JSON messages between one or more nodejs childs (fork or process), on the same machine or remote machines (TCP will be used in this case)
It break process.send existing system limits, bypasssing an unfixed bug in nodejs (oct 2017) https://github.com/nodejs/node/issues/9706
By default, json-stream is used. On the same box, better choice is json-stream over ipc.
WARNING about performances if you enable msgpack option ! (look at number of events and speed. Note that when using msgpack, if you go upper than 1000 events, you should have EPIPE errors, i don't know if my code is fucked, help welcome on this).
Tests below has been made on
TAP version 13
# Subtest: IPC/json-socket bench
ok 1 - connected
ok 2 - data sent
ok 3 - ipc: 100000 events sent in 0.313717 sec
ok 4 - ipc: send avg speed 16.9 MB/s
ok 5 - ipc: 100000 events received back
ok 6 - ipc: recv avg speed 1.9 MB/s
ok 7 - exit
1..7
ok 1 - IPC/json-socket bench # time=3029.013ms
1..1
# time=3034.874ms
TAP version 13
# Subtest: TCP/json-socket bench
ok 1 - connected
ok 2 - data sent
ok 3 - tcp: 100000 events sent in 0.415147 sec
ok 4 - tcp: send avg speed 12.7 MB/s
ok 5 - tcp: 100000 events received back
ok 6 - tcp: recv avg speed 1.6 MB/s
ok 7 - exit
1..7
ok 1 - TCP/json-socket bench # time=3629.3ms
1..1
# time=3635.214ms
TAP version 13
# Subtest: IPC/msgpack5-stream bench
ok 1 - connected
ok 2 - data sent
ok 3 - ipc: 1000 events sent in 0.092335 sec
ok 4 - ipc: send avg speed 551.2 KB/s
ok 5 - ipc: 1000 events received back
ok 6 - ipc: recv avg speed 261.9 KB/s
ok 7 - exit
1..7
ok 1 - IPC/msgpack5-stream bench # time=504.833ms
1..1
# time=517.265ms
TAP version 13
# Subtest: TCP/msgpack5-stream bench
ok 1 - connected
ok 2 - data sent
ok 3 - tcp: 1000 events sent in 0.114023 sec
ok 4 - tcp: send avg speed 446.3 KB/s
ok 5 - tcp: 1000 events received back
ok 6 - tcp: recv avg speed 234.7 KB/s
ok 7 - exit
1..7
ok 1 - TCP/msgpack5-stream bench # time=519.545ms
1..1
# time=525.174ms
Tests below has been made on the same laptop but inside a virtual machine
TAP version 13
# Subtest: IPC/json-socket bench
ok 1 - connected
ok 2 - data sent
ok 3 - ipc: 100000 events sent in 0.31976 sec
ok 4 - ipc: send avg speed 16.5 MB/s
ok 5 - ipc: 100000 events received back
ok 6 - ipc: recv avg speed 1.1 MB/s
ok 7 - exit
1..7
ok 1 - IPC/json-socket bench # time=4821.705ms
1..1
# time=4827.921ms
TAP version 13
# Subtest: TCP/json-socket bench
ok 1 - connected
ok 2 - data sent
ok 3 - tcp: 100000 events sent in 0.976478 sec
ok 4 - tcp: send avg speed 5.4 MB/s
ok 5 - tcp: 100000 events received back
ok 6 - tcp: recv avg speed 1.8 MB/s
ok 7 - exit
1..7
ok 1 - TCP/json-socket bench # time=3123.473ms
1..1
# time=3129.816ms
TAP version 13
# Subtest: IPC/msgpack5-stream bench
ok 1 - connected
ok 2 - data sent
ok 3 - ipc: 1000 events sent in 0.182411 sec
ok 4 - ipc: send avg speed 279.0 KB/s
master: client "ipc" socket error (write EPIPE)
ok 5 - ipc: 1000 events received back
ok 6 - ipc: recv avg speed 104.4 KB/s
ok 7 - exit
1..7
ok 1 - IPC/msgpack5-stream bench # time=704.899ms
1..1
# time=711.049ms
TAP version 13
# Subtest: TCP/msgpack5-stream bench
ok 1 - connected
ok 2 - data sent
ok 3 - tcp: 1000 events sent in 0.1694 sec
ok 4 - tcp: send avg speed 300.4 KB/s
ok 5 - tcp: 1000 events received back
ok 6 - tcp: recv avg speed 96.6 KB/s
ok 7 - exit
1..7
ok 1 - TCP/msgpack5-stream bench # time=736.877ms
1..1
# time=742.957ms
Cheers !
FAQs
Socket (TCP/IPC) based JSON Message for NodeJS
We found that sockmq demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.