
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
ws-additions
Advanced tools
Documentation Woefully Incomplete (DWI)
WebSockets should do some stuff out of the box that they don't, this package attempts to add that.
It appears useful to add some basic functionality to the native WebSocket. At the very least, it appears as if people find themselves coding the same basic functionality around the native WebSocket as we convert applications to be more WebSocket centric. This package intends to be a source of some of that common functionality bundled up for re-use, to avoid having people need to do the same things over and over.
It turns out we can make some assumptions in this whole process that make development a little easier, but may change the way you interact with WebSockets when you use this package.
onreconnect
and ondatanotsent
).While the only place this currently has been tested is in Chrome (newish versions) and nodejs, there are some QUnit tests available to prove it does (or doesn't) work.
git clone https://github.com/igroff/ws-additions.git
cd ws-additions/
make watch
Once you've done that successfully you should find a test page at http://localhost:8080/index.html
This package makes an object that looks a fair bit like a WebSocket available to you.
[Constructor(DOMString url)]
interface ReconnectingWebSocket : EventTarget {
attribute WebSocket underlyingWs;
// ready state
const unsigned short CONNECTING = 0;
const unsigned short OPEN = 1;
const unsigned short CLOSING = 2;
const unsigned short CLOSED = 3;
// networking
attribute EventHandler onopen;
attribute EventHandler onerror;
attribute EventHandler onclose;
attribute EventHandler onreconnect;
void close([Clamp] optional unsigned short code, optional DOMString reason);
// messaging
attribute EventHandler onmessage;
attribute EventHandler ondatanotsent;
void send(DOMString data);
void send(Blob data);
void send(ArrayBuffer data);
void send(ArrayBufferView data);
[Constructor(DOMString url)]
interface ReconnectingResendingWebSocket : EventTarget {
attribute WebSocket underlyingWs;
// ready state
const unsigned short CONNECTING = 0;
const unsigned short OPEN = 1;
const unsigned short CLOSING = 2;
const unsigned short CLOSED = 3;
// networking
attribute EventHandler onopen;
attribute EventHandler onerror;
attribute EventHandler onclose;
void close([Clamp] optional unsigned short code, optional DOMString reason);
// messaging
attribute EventHandler onmessage;
void send(DOMString data);
void send(Blob data);
void send(ArrayBuffer data);
void send(ArrayBufferView data);
You can consume the functionality in a couple ways, either by explicit creation of one of these 'enhanced WebSockets' or by replacing the native WebSocket implementation with the one of your choosing.
First of all, you'll to get the sucker into a format usable by your browser. 'round here we like browserify.
browserify -r ws-additions --outfile www/js/reconn.js
:shit: If you really want to, the most recent browserified version of this thing is down there in test/www/js/reconn.js
Then in an HTML page somewhere above js/reconn.js
<script src="js/reconn.js"></script>
<script>
var ReconnectingWebSocket = require("ws-additions").ReconnectingWebSocket;
var ws = new ReconnectingWebSocket("ws://localhost:8080/socket");
</script>
-- or --
<script src="js/reconn.js"></script>
<script>
var ReconnectingResendingWebSocket = require("ws-additions").ReconnectingResendingWebSocket;
var ws = new ReconnectingResendingWebSocket("ws://localhost:8080/socket");
</script>
With that, your ws
will handle reconnecting for you in the event that the
server at ws://localhost:8080/socket
disappears.
You can also opt to have it replace the native WebSocket, a polyfill if you will.
<script src="js/reconn.js"></script>
<script>
require("reconnecting-websocket").MakeWebSocketReconnecting();
// now all your calls to new WebSocket will return
// ReconnectingWebSockets!
var ws = new WebSocket("ws://localhost:8080/socket")
// woah, that was really dumb I wish to never create another
// ReconnectingWebSocket when calling new WebSocket
UnMakeWebSocketReconnecting();
</script>
-- or --
<script src="js/reconn.js"></script>
<script>
require("reconnecting-websocket").MakeWebSocketReconnectingAndResending();
// now all your calls to new WebSocket will return
// ReconnectingResendingWebSockets!
var ws = new WebSocket("ws://localhost:8080/socket")
// woah, that was really dumb I wish to never create another
// ReconnectingResendingWebSocket when calling new WebSocket
UnMakeWebSocketReconnectingAndResending();
</script>
FAQs
Helpful additional functionality for the vanilla WebSocket.
We found that ws-additions demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.