
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
yate-extmodule
Advanced tools
This Node.js module is a library for connecting external applications to Yate telephony engine. Details of control protocol are described here. Yate's extmodule documentation here.
Module supports local (piped) and socket operation modes. In socket mode one application can control many Yate instances, if needed.
npm install yate-extmodule
const extmodule = require('yate-extmodule')
Many things happen under the hood of this module to make developer's life easier.
Module automatically:
Yate can start one or more socket listeners and wait for external programs to connect to them. Depending on the platform, TCP and UNIX sockets may be available. Once connected, an external program uses this single socket to send commands and receive answers from the engine.
Example:
const extmodule = require('yate-extmodule')
let connection = extmodule.connect({host: '127.0.0.1', port: 5040}, () => {
console.log('connected')
})
connection.watch('engine.timer', (message) => {
console.log('tick', message.time)
})
See also examples directory
Example of Yate config file extmodule.conf
[listener external]
type=tcp
addr=0.0.0.0
port=5040
role=global
Module also supports UNIX sockets:
[listener unix]
type=unix
path=/tmp/extsocket
role=global
In this mode application runs locally and communicates with Yate through stdin/stdout file descriptors.
Such application is launched by Yate during startup or by internal command:
external start local.js
Local mode activates if neither port nor path are given to connect().
Example:
#!/usr/bin/node
const extmodule = require('yate-extmodule')
let connection = extmodule.connect(() => {
console.log('connected')
})
connection.watch('engine.timer', (message) => {
console.log('tick', message.time)
})
Example of Yate config file extmodule.conf
[scripts]
local.js=param
Some Yate modules may send messages with dotted keys, obviously imitating nested structure of parameters. Module can automatically convert nested objects according to this style.
Example:
{ 'CalledPartyAddress.route': 'gt',
'CalledPartyAddress.pointcode': '2002',
'CalledPartyAddress.gt.nature': 'international',
'CalledPartyAddress.gt.plan': 'isdn',
'CalledPartyAddress.gt.translation': '0',
'CalledPartyAddress.gt.encoding': 'bcd',
'CalledPartyAddress.gt': '2002',
'CalledPartyAddress.ssn': '6' }
{ CalledPartyAddress:
{ route: 'gt',
pointcode: '2002',
gt:
{ nature: 'international',
plan: 'isdn',
translation: '0',
encoding: 'bcd',
value: '2002' },
ssn: '6' } }
Decoration converts 'true' and 'false' values to boolean.
Decoration also auto-converts hex data in parameters (in form 'a0 b0', if length is 2 bytes or more) to Buffers and back.
Create new Connection(options, connectListener) and automatically connect to Yate.
Main Connection class.
Available options are:
Parameters:
Example:
const extmodule = require('yate-extmodule')
const config = {
host: '127.0.0.1',
port: 5040,
reconnect: true,
parameters: {
reenter: true,
timeout: 1000,
bufsize: 32768
}
}
const connection = extmodule.connect(config)
Activate connection
Send message to Yate for processing
Callback is optional, unless you care about the result of processing. If you do, here are arguments:
callback(err, retval, message)
Subscribe to process Yate messages having this name.
listener(message, retval)
Message is considered finalized ('processed') by default, and return value of this listener function becomes 'retval'. If application wants to indicate that message was not finalized, function should return object with corresponding keys: 'processed' and 'retval'. Nevertheless, object keys are all optional, and 'processed' key is again true by default.
Note: if you want to process your own dispatched messages, don't forget to set Connection options.parameters.reenter = true
Unsubscribe from messages having this name.
Subscribe to watch Yate messages having this name. You are not supposed to (and you can not) process message in this listener. Use subscribe for this.
Watching messages is different from subscribing to them: this event is a post-dispatching notifier, i.e. message has final state.
Note: if you want to watch your own dispatched messages, don't forget to set Connection options.parameters.selfwatch = true
Stop watching messages having this name.
Set connection parameter. See External module command flow
Result comes in callback(error, value)
Example:
connection.setlocal('timeout', 1000, false, (error, value) => {
console.log(error, value)
})
Get connection or engine parameter.
Alias to setlocal(name, value, callback)
Example:
connection.getlocal('engine.configpath', (err, result) => {
console.log(err, result)
})
Get configuration parameter of Yate main config file.
Result comes in callback(error, value)
Example:
connection.getconfig('modules', 'msgsniff.yate', (error, value) => {
console.log(error, value)
})
Send control command to Yate and get feedback
Result comes in callback(error, result)
Example:
connection.command('sniffer off', (err, result) => {
console.log(err, result)
})
This property takes the value of argument supplied to executed script. Equals to process.argv[2].
Example:
[scripts]
local.js=debug // connection.arg --> 'debug'
Copyright (c) 2016-2018 Vladimir Latyshev
License: MIT
FAQs
Node.js library for YATE (Yet Another Telephone Engine)
We found that yate-extmodule demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.