Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
ws
interface.ws
(if they are "fastest", we are "fastester").Implementation | User space memory scaling | Connection performance | Short message throughput | Huge message throughput |
---|---|---|---|---|
libwebsockets 2.0 | µWS is 11x as lightweight | µWS is equal in performance | µWS is 6x as performant | µWS is 4x in performance |
ws v1.1.0 + binary addons | µWS is 47x as lightweight | µWS is 18x as performant | µWS is 33x as performant | µWS is 2x as performant |
WebSocket++ v0.7.0 | µWS is 63x as lightweight | µWS is 4x as performant | µWS is 3x as performant | µWS is 2x as performant |
Kaazing Gateway Community 5.0.0 | µWS is 62x as lightweight | µWS is 15x as performant | µWS is 18x as performant | unable to measure |
Benchmarks are run with default settings in all libraries, except for ws
which is run with the native performance addons. These results were achieved with the native C++ server, not the Node.js addon. Expect worse performance and scalability when using Node.js (don't worry, the Node.js addon will run circles around ws
).
“With changing one letter in the code from "ws" to "uws" I've been able to serve twice as many players for the same cost.” - Rezoner / wilds.io
We built µWS
with the existing Node.js infrastructure in mind. That's why we target the widespread ws
interface, allowing us to seamlessly integrate with projects like SocketCluster, Socket.IO & Primus.
Use the new wsEngine: 'uws'
option like so:
var socketCluster = new SocketCluster({ wsEngine: 'uws' });
We've worked closely together with the SocketCluster team and aim to bring you µWS
as the default WebSocket engine in SocketCluster 5.
Use the new wsEngine: 'uws'
option like so:
var io = require('socket.io')(80, { wsEngine: 'uws' });
This option has not yet been released, one alternative way of enabling uws
in current versions of Socket.IO is:
var io = require('socket.io')(80);
io.engine.ws = new (require('uws').Server)({
noServer: true,
clientTracking: false,
perMessageDeflate: false
});
Set 'uws' as transformer:
var primus = new Primus(server, { transformer: 'uws' });
If your code directly relies on ws
you can simply swap require('ws')
with require('uws')
:
var WebSocketServer = require('uws').Server; /* you replace 'ws' with 'uws' */
var wss = new WebSocketServer({ port: 8080 });
wss.on('connection', function (ws) {
ws.on('message', function (message) {
console.log('received: ' + message);
});
ws.send('something');
});
For maximum performance and memory scaling the native interface is recommended. Look in the examples folder for threading and load balancing examples. There is no documentation written yet but a bright person like you will have no problem just reading the header file.
int main()
{
/* this is an echo server that properly passes every supported Autobahn test */
uWS::Server server(3000);
server.onConnection([](uWS::WebSocket socket) {
cout << "[Connection] clients: " << ++connections << endl;
});
server.onMessage([](uWS::WebSocket socket, char *message, size_t length, uWS::OpCode opCode) {
socket.send(message, length, opCode);
});
server.onDisconnection([](uWS::WebSocket socket) {
cout << "[Disconnection] clients: " << --connections << endl;
});
server.run();
}
npm install --save uws
Node.js is broken on Windows and needs to be fixed for us to support the platform
If you for some reason want and/or need to build the Node.js addon from source:
cd uWebSockets/nodejs
make
This populates the nodejs/dist folder with binaries.
First of all you need to install the required dependencies. On Unix systems this is typically done via package managers, like homebrew in the case of OS X or dnf
in the case of Fedora Linux. On Windows you need to search the web for pre-compiled binaries or simply compile the dependencies yourself.
Obviously you will need to clone this repo to get the sources. We use CMake as build system.
git clone https://github.com/alexhultman/uWebSockets.git && cd uWebSockets
cmake .
Now, on Unix systems it should work by simply running make
. Run [sudo] make install
as you wish.
If you are running Windows you should now have a bunch of Visual Studio project files and one solution file. Open the solution file, now you need to make sure the header include paths and library paths are all set according to where you installed the dependencies. You might also need to change the names of the libraries being linked against, all according to the names of the installed library files. You know the drill.
FAQs
Highly scalable WebSocket server library
The npm package uuws receives a total of 80 weekly downloads. As such, uuws popularity was classified as not popular.
We found that uuws demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.