
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
RTCRoomConnectionClient;RTCPeerConnectionClient;RTCPeerConnectionServer: simple usage RTC peer connection to handle only what we need without to enter the details like STUN SDP ICE and so on, also great handler for stream functionality in classes like: Sc
A robust TypeScript signaling solution for WebRTC applications using Socket.io as the signaling mechanism. The package provides an extensible and simple API for both server-side (signaling server) and client-side (browser/app) logic, enabling fast development of peer-to-peer video, audio, or data channels.
Install dependencies:
for server side
npm install stream-rtc socket.io
for client side
npm install stream-rtc socket.io-client
import { Server } from 'socket.io';
import { RTCPeerConnectionServer } from 'stream-rtc';
const io = new Server(3000);
io.on('connection', (socket) => {
const userId = socket.handshake.auth.userName || socket.id;
new RTCPeerConnectionServer(socket, userId);
});
RTCPeerConnectionServer for each new socket.import { io } from 'socket.io-client';
import { RTCPeerConnectionClient } from 'stream-rtc';
const socket = io('http://localhost:3000');
const rtcClient = new RTCPeerConnectionClient(socket, { userId: 'user-A' });
rtcClient.onOffersReceived((offers)=>{
const offerOptions = offers;
offerOptions.forEach(o => {
o.onClick = () => {
rtcClient.answerOffer().then(([localStream, remoteStream]) => {
// Attach localStream and remoteStream to <video> HTML elements as needed, or include them in constructur props
});
}
})
// render offerOptions options
});
rtcClient.call().then(([localStream, remoteStream]) => {
// Attach localStream and remoteStream to <video> HTML elements as needed, or include them in constructur props
});
import { io } from 'socket.io-client';
import { RTCRoomConnectionClient, type RoomInfo } from 'stream-rtc';
const socket = io('http://localhost:3000');
const rtcClient = new RTCRoomConnectionClient(socket, { userId: getUserName(), localVideoElement }, { debugMode: true });
// first user should create room like that
...
await pc.createRoom(roomName, {
maxParticipants: 10,
isPrivate: false,
constraints: { video: true, audio: true },
});
...
// #################################################
// the rest users should join the room like that:
...
await pc.joinRoom(roomId, { video: true, audio: true });
...
call() to request media permissions and initiate a connection.answerOffer().call() or answerOffer().PEER_CONFIGURATION in consts.ts for different STUN/TURN servers.{ debugMode: true } to the client constructor to enable logging.how to allow Chrome use camera/min on untrast https localhost certificate
go chrome flags click here

add your specific url like: https://localhost:8181
then refresh button will appear click it
done! go to your chrome host and use camera!

MIT License
For full source and documentation, visit the example of working demo directory in the repository.
FAQs
RTCRoomConnectionClient;RTCPeerConnectionClient;RTCPeerConnectionServer: simple usage RTC peer connection to handle only what we need without to enter the details like STUN SDP ICE and so on, also great handler for stream functionality in classes like: Sc
We found that stream-rtc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.