Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Universal API for realtime services. Integrate once and easily switch between Socket.io, Ably and PubNub.
Provides handy methods for rooms, users, message history, and information about connected user.
Supported realtime services:
Install via NPM.
npm install urltm --save
Include library via require.
const urltm = require('urltm');
Install via bower or NPM
npm install urltm --save
bower install urltm --save
Include library in HTML.
<script src="./bower_components/web/urltm.js"></script>
Both the NodeJS and web libraries are configured with the urltm
variable.
let user = urltm({
service: 'pubnub',
config: {
// ...
}
});
service
is the name of the realtime service to use (ably
, pubnub
or socketio
)config
is a Javascript object with a config for that service.Socket.io is an open source websocket framework. To use socket.io, you'll run your own socket.io server on the back end.
PubNub is a hosted realtime solution that doesn't require you to run or maintain any servers.
Ably is a hosted realtime solution that doesn't require you to run or maintain any servers.
Every user
connected to urltm.js has two properties:
uuid
- a unique way to identify this user
state
- data associated with this user
You can provide these as parameters during initialization.
let user = urltm({
service: 'socketio',
config: {
endpoint: 'http://localhost:9000',
uuid: 'MY_UNIQUE_ID',
state: {admin: true}
}
});
Realtime communication happens over room
s. room
s are like chat rooms, everybody in a room
receives events sent by every other user
.
A user
can join a room
by using the join()
method and supplying a room
identifier. user
s who provide the same identifier will be able to communicate with each other.
room = user.join('room-name');
This returns a room
object which we can use to communicate with other user
s.
A room can subscribe to the join
event to find out when other user
s join the room.
room.on('join', (uuid, state) => {
console.log('user with uuid', uuid, 'joined with state', state);
});
When another user
sends a message to the room
, it will trigger the message
event. The room
can subscribe to that event with the on()
method.
room.on('message', (uuid, data) => {
console.log('message received from uuid', uuid, 'with data', data);
});
To send a message to the entire room
, use the message()
method. Returns a promise.
room.message({hello: world}).then(() => {
console.log('message published');
});
A room
can get a list of other user
s who have in the room
by using the here()
method. Returns a promise.
room.here().then((users) => {
console.log('users online', users);
});
Successful responses will return a object of user
s who are currently connected to the room
. The keys are the user
's uuid
s and the values are their current state
.
{
uuid1: {
username: 'ianjennings'
},
uuid2: {
username: 'stephenblum'
}
}
A room
can subscribe to the leave
event to find out when a user
leaves.
room.on('leave', (uuid) => {
console.log('user with uuid', uuid, 'has left');
});
A user
can manually leave a room
by using the leave()
method. Returns a promise.
room.leave().then(() => {
console.log('left the room.');
});
This will fire the leave
event.
If a user
gets disconnected without leaving the room, the disconnect
event will fire.
room.on('disconnect', (uuid) => {
console.log('user with uuid', uuid, 'has disconnected');
});
A user
state can be updated at any time by using the state()
method. Supply the new state
as the only parameter. Return a promise.
room.state({idle: true}).then(() => {
console.log('state set');
});
This will fire the state
event which you can subscribe to with the room.on()
method. When fired you will get the uuid
of the user
and the new state
.
room.on('state', (uuid, state) => {
console.log('user with uuid', uuid, 'was given state', state);
});
A user
can retrieve previously published messages in the room
by using the history()
method. Returns a promise.
room.history().then((history) => {
console.log('got array of all messages in channel', history);
});
It will return the last 100 messages as an array of objects containing the uuid
and data
of every message. The array is sorted newest to oldest.
[
{
uuid: uuid2,
data: {
sentTime: '2pm',
text: 'boy howdy'
}
},
{
uuid: uuid1,
data: {
sentTime: '1pm',
text: 'hello there'
}
}
]
Tests are run with mocha and chai.
npm install mocha -g
npm install chai -g
Set environment variable CLIENT
to test each service.
env CLIENT=ably mocha
env CLIENT=pubnub mocha
env CLIENT=socketio mocha
FAQs
abstraction for realtime frameworks
The npm package urltm receives a total of 1 weekly downloads. As such, urltm popularity was classified as not popular.
We found that urltm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.