Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
ØMQ bindings for Node.js. The goals of this library are:
async
/await
and async
iterators.Install ZeroMQ.js with prebuilt binaries:
npm install zeromq
Requirements for using prebuilt binaries:
The following platforms have a prebuilt binary available:
If a prebuilt binary is not available for your platform, installing will attempt to start a build from source.
If a prebuilt binary is unavailable or if you want to pass certain options during build, you can build this package from source.
Make sure you have the following installed before attempting to build from source:
To install from source, specify build_from_source=true
in a .npmrc
file
build_from_source=true
When building from source, you can also specify additional build options in a
.npmrc
file in your project:
By default libzmq
is built with support for Draft
patterns (e.g.
server-client
, radio-dish
, scatter-gather
). If you want to build libzmq
without support for Draft
, you can specify the following in .npmrc
:
zmq_draft=false
If you want to send/receive on the socket immediately, you can specify the
following in .npmrc
:
zmq_no_sync_resolve="true"
If you want to link against a shared ZeroMQ library installed on your system,
you can build skip downloading libzmq
and link with the installed library
instead by specifying the following in .npmrc
:
zmq_shared=true
You can specify an alternative version or Git revision of libzmq
to build
against by specifying the following in .npmrc
:
zmq_version="4.3.5"
If you want to build libzmq
with debug symbols, you can specify the following
in .npmrc
:
zmq_build_type="Debug"
If you want to cross-compile for a different architecture, you can specify the
following in .npmrc
:
arch="arm64"
target_arch="arm64"
If you want to specify the MacOS deployment target, you can specify the
following in .npmrc
:
macos_deployment_target="10.15"
Note: These examples assume the reader is familiar with ZeroMQ. If you are new to ZeroMQ, please start with the ZeroMQ documentation.
More examples can be found in the examples directory.
This example demonstrates how a producer pushes information onto a socket and how a worker pulls information from the socket.
producer.js
Creates a producer to push information onto a socket.
const zmq = require("zeromq")
async function run() {
const sock = new zmq.Push()
await sock.bind("tcp://127.0.0.1:3000")
console.log("Producer bound to port 3000")
while (true) {
await sock.send("some work")
await new Promise(resolve => {
setTimeout(resolve, 500)
})
}
}
run()
worker.js
Creates a worker to pull information from the socket.
const zmq = require("zeromq")
async function run() {
const sock = new zmq.Pull()
sock.connect("tcp://127.0.0.1:3000")
console.log("Worker connected to port 3000")
for await (const [msg] of sock) {
console.log("work: %s", msg.toString())
}
}
run()
This example demonstrates using zeromq
in a classic Pub/Sub,
Publisher/Subscriber, application.
publisher.js
Create the publisher which sends messages.
const zmq = require("zeromq")
async function run() {
const sock = new zmq.Publisher()
await sock.bind("tcp://127.0.0.1:3000")
console.log("Publisher bound to port 3000")
while (true) {
console.log("sending a multipart message envelope")
await sock.send(["kitty cats", "meow!"])
await new Promise(resolve => {
setTimeout(resolve, 500)
})
}
}
run()
subscriber.js
Create a subscriber to connect to a publisher's port to receive messages.
const zmq = require("zeromq")
async function run() {
const sock = new zmq.Subscriber()
sock.connect("tcp://127.0.0.1:3000")
sock.subscribe("kitty cats")
console.log("Subscriber connected to port 3000")
for await (const [topic, msg] of sock) {
console.log(
"received a message related to:",
topic,
"containing message:",
msg,
)
}
}
run()
This example illustrates a request from a client and a reply from a server.
client.js
const zmq = require("zeromq")
async function run() {
const sock = new zmq.Request()
sock.connect("tcp://127.0.0.1:3000")
console.log("Producer bound to port 3000")
await sock.send("4")
const [result] = await sock.receive()
console.log(result)
}
run()
server.js
const zmq = require("zeromq")
async function run() {
const sock = new zmq.Reply()
await sock.bind("tcp://127.0.0.1:3000")
for await (const [msg] of sock) {
await sock.send(2 * parseInt(msg, 10))
}
}
run()
This library provides typings for TypeScript version 3.0.x and later.
Requirements
compilerOptions.target
to esnext
or later (e.g. es2018
)compilerOptions.lib
(and
include their corresponding polyfills if needed): es2015
,
ESNext.AsyncIterable
Example Usage
import {Request} from "zeromq"
// or as namespace
import * as zmq from "zeromq"
const reqSock = new Request()
//...
const repSock = new zmq.Reply()
More advanced examples can be found in the examples directory of this repository.
Or you can browse the API reference documentation to see all socket types, methods & options as well as more detailed information about how to apply them.
The next generation version of the library features a compatibility layer for ZeroMQ.js versions 4 and 5. This is recommended for users upgrading from previous versions.
Example:
const zmq = require("zeromq/v5-compat")
const pub = zmq.socket("pub")
const sub = zmq.socket("sub")
pub.bind("tcp://*:3456", err => {
if (err) throw err
sub.connect("tcp://127.0.0.1:3456")
pub.send("message")
sub.on("message", msg => {
// Handle received message...
})
})
If you are interested in making contributions to this project, please read the following sections.
In order to develop and test the library, you'll need the tools required to build from source (see above).
Additionally, having clang-format is strongly recommended.
Socket and context options can be set at runtime, even if they are not implemented by this library. By design, this requires no recompilation if the built version of ZeroMQ has support for them. This allows library users to test and use options that have been introduced in recent versions of ZeroMQ without having to modify this library. Of course we'd love to include support for new options in an idiomatic way.
Options can be set as follows:
const {Dealer} = require("zeromq")
/* This defines an accessor named 'sendHighWaterMark', which corresponds to
the constant ZMQ_SNDHWM, which is defined as '23' in zmq.h. The option takes
integers. The accessor name has been converted to idiomatic JavaScript.
Of course, this particular option already exists in this library. */
class MyDealer extends Dealer {
get sendHighWaterMark(): number {
return this.getInt32Option(23)
}
set sendHighWaterMark(value: number) {
this.setInt32Option(23, value)
}
}
const sock = new MyDealer({sendHighWaterMark: 456})
When submitting pull requests for new socket/context options, please consider the following:
camelCase
naming conventions.The test suite can be run with:
npm install
npm run build
npm run test
The test suite will validate and fix the coding style, run all unit tests and verify the validity of the included TypeScript type definitions.
Some tests are not enabled by default:
INCLUDE_COMPAT_TESTS=1 npm run test
To publish a new version, run:
npm version <new version>
git push && git push --tags
Wait for continuous integration to finish. Prebuilds will be generated for all
supported platforms and attached to a Github release. Documentation is
automatically generated and committed to gh-pages
. Finally, a new NPM package
version will be automatically released.
Version 6+ is a complete rewrite of previous versions of ZeroMQ.js in order to
be more reliable, correct, and usable in modern JavaScript & TypeScript code as
first outlined in this issue.
Previous versions of ZeroMQ.js were based on zmq
and a fork that included
prebuilt binaries.
See detailed changes in the CHANGELOG.
FAQs
Next-generation ZeroMQ bindings for Node.js
The npm package zeromq receives a total of 37,836 weekly downloads. As such, zeromq popularity was classified as popular.
We found that zeromq demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.