
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
zeroframe-ws-client
Advanced tools
ZeroFrame WebSocket API for JavaScript.
This is JavaScript WebSocket client for ZeroFrame API. It supports (almost) same features as default ZeroFrame that is included in ZeroNet sites, but it is using WebSocket client so it can be used in local programs, such as Node.js and Electron. It can't be used in browsers because of CORS restrictions.
ZeroFrameJS requires Node.js 10 or higher.
The recommended way to install ZeroFrameJS is with Yarn.
yarn add zeroframe-ws-client
Alternatively, you can also install it with NPM but it won't respect yarn.lock file.
npm install --save zeroframe-ws-client
You can import ZeroFrameJS with CJS or ESM.
const ZeroFrame = require('zeroframe-ws-client') // Using CJS
import ZeroFrame from 'zeroframe-ws-client' // Using ESM
To create a connection, you need to specify the ZeroNet site address.
const zeroframe = new ZeroFrame('1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D')
If ZeroNet instance is using Multiuser plugin, you need to specify a master address of the account you want to use. Account must already exist on the instance.
const zeroframe = new ZeroFrame(
'1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D', {
multiuser: {
masterAddress: '1Hxki73XprDRedUdA3Remm3kBX5FZxhFR3'
}
})
If you want to create a new account, you also need to specify a master seed of it. Note that this feature is unsafe on the untrusted proxy. Also, it is currently not implemented yet.
const zeroframe = new ZeroFrame(
'1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D', {
multiuser: {
masterAddress: '1KAtuzxwbD1QuMHMuXWcUdoo5ppc5wnot9',
masterSeed: 'fdbaf75427ba69a3d4aa8e19372e05879e9e2d866e579dd30be25e6fab7e3fb2'
}
})
If needed, you can also specify protocol, host and port of ZeroNet instance.
const zeroframe = new ZeroFrame(
'1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D', {
instance: {
host: '192.168.1.1',
port: 8080,
secure: true
}
})
Log and error message from zeroframe.log and zeroframe.error will not be displayed by default. If you want to, you can also display them as debug info.
const zeroframe = new ZeroFrame(
'1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D', {
show: {
log: true,
error: true
}
})
By default, the client will try to reconnect WebSocket if the connection was closed every 5 seconds. You can also configure time delay and total attempts. Delay is specified in milliseconds. The number of attempts -1 means infinity and 0 means zero (disabled reconnecting).
const zeroframe = new ZeroFrame(
'1HeLLo4uzjaLetFx6NH3PMwFP3qbRbTf3D', {
reconnect: {
attempts: 10,
delay: 1000
}
})
The client will then obtain wrapper key to the site and connect to WebSocket using it.
You can now normally use ZeroFrame API. Just remember that there is no wrapper, so wrapper commands are not available. The client is connected directly to the WebSocket server, so you need to use its commands.
Note that the WebSocket server sometimes sends commands (notification, progress, error, prompt, confirm, setSiteInfo, setAnnouncerInfo, updating, redirect, injectHtml, injectScript) that are normally handled by the wrapper. Because there is no wrapper, you need to handle those commands yourself if needed. Commands response and ping are already handled by this client so you don't need to handle them.
You can use the cmd method to issue commands.
zeroframe.cmd(
'siteInfo',
{},
(result) => {
console.log(result)
}
)
You can also use the cmdp method to get results as JavaScript promises.
let result = await zeroframe.cmdp('siteInfo', {})
To submit responses, you need to use response command.
zeroframe.response(10, 'Hello World')
There are also log and error methods which are available for logging. They will display output to console if enabled.
zeroframe.log('Connected')
zeroframe.error('Connection failed')
There are also public handler methods which you can overwrite to add your own logic to ZeroFrame.
class ZeroApp extends ZeroFrame {
onRequest (cmd, message) {
if (cmd === 'helloWorld') {
this.log('Hello World')
}
}
onOpenWebsocket (event) {
this.log('Connected to WebSocket')
}
onErrorWebsocket (event) {
this.error('WebSocket connection error')
}
onCloseWebsocket (event) {
this.error('WebSocket connection closed')
}
}
You can use close method to close WebSocket connection to ZeroFrame API.
zeroframe.close()
You can also directly call commands via Proxy object. Command name is accepted as an object's property and parameters are accepted as a method's arguments. Command returns Promise with the result.
zeroframe.proxy.cmdName().zeroframe.proxy.cmdName({key1: value1, key2: value2}).zeroframe.proxy.cmdName(value1, value2).let siteInfo = await zeroframe.proxy.siteInfo()
You could also look to example.js or API documentation.
This library uses SemVer for versioning. For the versions available, see the tags on this repository.
This library is licensed under the MIT license. See the LICENSE file for details.
FAQs
ZeroFrame WebSocket API for JavaScript
We found that zeroframe-ws-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.