Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This is a websocket-based real-time communication server, your applications communicate with it via simple JSON REST API.
Visit http://channelstream.org for more information.
Obtain source from github and do:
YOUR_PYTHON_ENV/bin/pip install channelstream
Generate new configuration:
YOUR_PYTHON_ENV/bin/channelstream_utils make_config -o config.ini
Start the server:
YOUR_PYTHON_ENV/bin/channelstream -i config.ini
Demo applications live in https://github.com/Channelstream/channelstream_demos repository.
They show common patterns used in real-time applications.
Channelstream provides API explorer that you can use to interact with various endpoints, it is available by default under http://127.0.0.1:8000/api-explorer.
To send information client interacts only with your normal www application. Your app handled authentication and processing messages from client, then passed them as signed message to channelstream server for broadcast.
websocket client -> webapp (security and transformation happens here) -> REST call to socket server -> broadcast to other clients
This model is easy to implement, secure, easy to scale and allows all kind of languages/apps/work queues to interact with socket server.
All messages need to be signed with a HMAC of destination endpoint ::
import requests
from itsdangerous import TimestampSigner
signer = TimestampSigner(SERVER_SECRET)
sig_for_server = signer.sign('/connect')
secret_headers = {'x-channelstream-secret': sig_for_server,
'Content-Type': 'application/json'}
response = requests.post(url, data=json.dumps(payload),
headers=secret_headers).json()
Please consult API Explorer (http://127.0.0.1:8000/api-explorer) for in depth information about endpoints.
Some examples:
Client API
Admin API
Responses to client are in form of list containing objects:
examples:
new message ::
{
"date": "2011-09-15T11:36:18.471862",
"message": MSG_PAYLOAD,
"type": "message",
"user": "NAME_OF_POSTER",
"channel": "CHAN_NAME"
}
presence info ::
{
"date": "2011-09-15T11:43:47.434905",
"message": {"action":"joined/parted"},
"type": "presence",
"user": "NAME_OF_POSTER",
"channel": "CHAN_NAME"
}
Currently following message types are emited: message
, message:edit
,
message:delete
, presence
, user_state_change
.
FAQs
Websocket server supporting channels/users communication
We found that channelstream demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.