
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
webstomp-client
Advanced tools
This library provides a stomp client for Web browsers and nodejs through Web Sockets.
This is a fork of the original stomp-websocket re-written in ES6 and incorporate pending pull requests. All credits goes to the original authors: Jeff Mesnil & Jeff Lindsay.
Only ES5 compatible modern browsers are supported. If you need a websocket polyfill you can use sockjs
As nodejs does not have a WebSocket object like browsers have, you must choose a websocket client and use webstomp.over instead of webstomp.client. Choosing a good client is maybe the most difficult part:
npm run example will open examples in browser and try to connect to RabbitMQ Web-Stomp default Web Sockets url.
node run example/broadcast-node.js will run a dead simple nodejs example.
npm install webstomp-client
<script type="text/javascript" src="node_modules/webstomp-client/dist/webstomp.min.js"></script>
webstomp will be a global variable.
var webstomp = require('webstomp-client');
import webstomp from 'webstomp-client';
By default it will load dist/webstomp.js, but the npm package.json es6 entry point to the es6 src file if you prefer loading this version.
Jeff Mesnil stomp-websocket documentation is still a must read even if the API evolved a little
Uses global WebSocket object for you to return a webstomp Client object.
Web Sockets endpoint url
['v10.stomp', 'v11.stomp', 'v12.stomp']false. See binary section.{incoming: 10000, outgoing: 10000}. You can provide false to cut it (recommended when the server is a SockJS server) or a definition object.true. Will log frame using console.logTakes a WebSocket alike object instance to return a webstomp Client object. Allows you to use another WebSocket object than the default one. 2 cases for this:
webstomp.client to create a default instance for you.WebSocket object that webstomp.client can use.WebSocket object instance
false. See binary section.{incoming: 10000, outgoing: 10000}. You can provide false to cut it (recommended when the server is a SockJS server) or a definition object.true. Will log frame using console.logList all STOMP specifications supported.
List all websocket STOMP protocols supported. Useful when creating your own WebSocket instance, although optional, protocols is often the second parameter.
A client instance can and should be created through webstomp.client or webstomp.over
connect(headers, connectCallback)connect(headers, connectCallback, errorCallback)connect(login, passcode, connectCallback)connect(login, passcode, connectCallback, errorCallback)connect(login, passcode, connectCallback, errorCallback, host)It is preferable to unsubscribe from a subscription by calling unsubscribe() directly on the object returned by client.subscribe()
var subscription = client.subscribe(destination, onmessage);
...
subscription.unsubscribe(headers);
headers are optionals
If defined on the client instance this function will be called whenever a message is received and in the absence of an explicit subscribe(). Some brokers (at least RabbitMQ) will setup an internal routing topology for RPC patterns when a message is sent with certain headers.
In RabbitMQ it's called Direct Reply-To
On the client
let onreceive(frame)=>{
console.log('Message received',frame)
}
client.onreceive=onreceive
let headers = {
'reply-to' :'/temp-queue/webstomp',
}
client.send('/topic/public.echo.hi.mom','a message')
On the server (using Amqplib for example)
ch.publish('',raw_message.properties.replyTo,Buffer.from('a reply'))
If no transaction ID is passed, one will be created automatically
It is preferable to commit a transaction by calling commit() directly on the object returned by client.begin():
var tx = client.begin(txid);
...
tx.commit();
It is preferable to abort a transaction by calling abort() directly on the object returned by client.begin():
var tx = client.begin(txid);
...
tx.abort();
It is preferable to acknowledge a message by calling ack() directly on the message handled by a subscription callback:
client.subscribe(destination, (message) => {
// process the message
// acknowledge it
message.ack();
}, {'ack': 'client'}
);
It is preferable to nack a message by calling nack() directly on the message handled by a subscription callback:
client.subscribe(destination, (message) => {
// process the message
// acknowledge it
message.nack();
}, {'ack': 'client'}
);
Will use console.log by default. Override it to update its behavior.
It is possible to use binary frame instead of string frame over Web Sockets.
Not all server are compatible, you may have to deactivate this feature depending the server you are using. For example RabbitMQ Web-Stomp is compatible only since 3.6 with native Web Sockets server.
FAQs
Stomp client over websocket for browsers and nodejs
The npm package webstomp-client receives a total of 10,897 weekly downloads. As such, webstomp-client popularity was classified as popular.
We found that webstomp-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.