Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
#Stream-pkg
Stream-pkg is a simple tool for packages that transfered on stream-based API.
As we known, stream API is a good thing of Node.js and we could compose different applications by stream-based API conventionally. And package may be splited into small chunks when it transfered on stream-based API such as socket. We have to recompose the chunks into package when we receive them. But we have to do some jobs to find out when we get enough data to recover the original package.
Stream-pkg add a simple header for each package and the header uses variable length to record the length of the package. The header contains several bytes. The highest bit of each byte indicates whether current byte is the last byte of the header. 0 for so and 1 for not. And the low 7 bits are the data of the length value. We can read the length of package from the header and then recover the package from the rest of data. And inside stream-pkg, we use a FSM to figure out when we should parse the header part and when we should parse the data part.
##Installation
npm install stream-pkg
##Usage
var Composer = require('stream-pkg');
var src = 'Hello world.';
var comp = new Composer();
// package to data
var res = comp.compose(src);
// data to package
comp.on('data', function(data) {
var str = data.toString('utf-8');
str.should.equal(src);
done();
});
comp.feed(res);
And we can use stream-pkg in a socket-based echo server and client as below:
###sever.js
var net = require('net');
var Composer = require('stream-pkg');
var server = net.createServer(function(socket) {
var composer = new Composer();
composer.on('data', function(pkg) {
console.log('package receive: %j', pkg.toString());
socket.write(composer.compose(pkg));
});
socket.on('data', function(data) {
composer.feed(data);
});
socket.on('end', function(data) {
composer.feed(data);
socket.end();
server.close();
});
});
server.listen(8888);
###client.js
var net = require('net');
var Composer = require('stream-pkg');
var client = net.connect({port: 8888});
var composer = new Composer();
var count = 3;
var src = 'hello world!';
var revCount = 0;
composer.on('data', function(pkg) {
if(pkg.toString() === src) {
console.log('ok');
} else {
console.log('fail');
}
revCount++;
if(revCount >= count) {
client.end();
}
});
client.on('data', function(data) {
composer.feed(data);
});
for(var i=0; i<count; i++) {
client.write(composer.compose(src));
}
##API ###composer.compose(pkg) Compose package into byte data. ####Arguments
###composer.feed(data, [offset], [end]) Feed data into composer. ####Arguments
##Event ###'data'(pkg) Emit package by data event when the package has finished. ###'length_limit'(composer, data, offset) Emit when the package exceeds the limit of package size.
FAQs
A simple tool to compose package for stream based API, such as tcp socket.
The npm package stream-pkg receives a total of 133 weekly downloads. As such, stream-pkg popularity was classified as not popular.
We found that stream-pkg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.