Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
udp-hole-puncher
Advanced tools
JS library implementing a UDP hole punching protocol to connect two peers located behind NAT devices. Will not work when one or both peers are located behind a symmetric NAT box. In that case, you may need a relay server + a TURN lib (like this one) to facilitate communication between both peers.
npm install udp-hole-puncher
const dgram = require('dgram');
const UdpHolePuncher = require('udp-hole-puncher');
// peer's public port and address
const peer = {
port: 1234,
addr: '1.2.3.4',
};
// local port
const myPort = 5678;
// socket config
const socket = dgram.createSocket('udp4');
socket.on('error', (error) => {...} );
socket.on('message', (message, rinfo) => {...} );
socket.on('listening', () => {
// puncher config
const puncher = new UdpHolePuncher(socket);
// when connection is established, send dummy message
puncher.on('connected', () => {
const message = Buffer.from('hello');
socket.send(message, 0, message.length, peer.port, peer.addr);
});
// error handling code
puncher.on('error', (error) => {
...
});
// connect to peer (using its public address and port)
puncher.connect(peer.addr, peer.port);
});
// bind socket
socket.bind(myPort);
var puncher = new UdpHolePuncher(socket, args)
Create a new udp-hole-puncher.
socket
must be an operational datagram socket.
args
specifies some optional config settings, including the maximum request attempts + timeout between every request attempt (ms). Default settings are { maxRequestAttempts: 10, requestTimeout: 500 }
puncher.connect(addr, port)
Try to establish a connection with a peer using its public address and port. Note that to setup bidirectional communication, both peers must simultaneously execute a connect operation (initiating the punching protocol).
puncher.close()
End execution of the hole punching protocol.
puncher.on('connected', () => {})
Fired when the hole punching protocol completes and both peers can reach each other.
puncher.on('reachable', () => {})
Called when the other peer was able to reach this peer. No guarantee yet that bidirectional communication can be established.
puncher.on('timeout', () => {})
Fired when the hole punching protocol timeouts.
puncher.on('error', (error) => {})
Fired when a fatal error occurs.
gulp browserify [--production]
Puts udp-hole-puncher.debug.js
and udp-hole-puncher.min.js
in build
folder. Can be used in chrome and cordova app. When integrating udp-hole-puncher in a cordova app, use cordova-plugin-chrome-apps-sockets-udp
:
cordova plugin add https://github.com/MobileChromeApps/cordova-plugin-chrome-apps-sockets-udp
See examples directory. Note that both peers should not be located behind the same NAT device. To test this lib, deploy one peer on your home network and another one outside of that network -- for instance on a public cloud infrastructure.
To run this test example, execute the following cmd on two machines A and B:
server-A$ npm run-script peer -- --bind=12345 --addr=<PUBLIC ADDR OF B> --port=23456
server-B$ npm run-script peer -- --bind=23456 --addr=<PUBLIC ADDR OF A> --port=12345
FAQs
UDP hole punching library
The npm package udp-hole-puncher receives a total of 26 weekly downloads. As such, udp-hole-puncher popularity was classified as not popular.
We found that udp-hole-puncher demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.