Registry / http-networking / ssh2-streams

ssh2-streams

JSON →
library0.4.10jsnpmunverified

ssh2-streams is a low-level Node.js library that provides direct, stream-based implementations of the SSH2 and SFTPv3 client/server protocols. It serves as a foundational component for higher-level SSH libraries, such as `ssh2`, offering granular control over the protocol handshake, channel management, and data transfer mechanisms. The current stable version is 0.4.10, and as a core utility, its release cadence is typically driven by security patches, bug fixes, and minor protocol compliance updates rather than rapid feature development. Its primary differentiators include its efficient Node.js stream integration, allowing for flexible and performant handling of network I/O, and its commitment to exposing the raw protocol events and structures, enabling developers to build custom SSH or SFTP solutions with deep control over the underlying communication. It requires Node.js v5.10.0 or newer.

npm install ssh2-streams
INSTALL
IMPORT
SIG · SSH2-STREAMS
S
ssh2-streams
http-networkingjavascriptv0.4.10
Install
Import
Disk
Pass rate
0/ 6
Env Coverage0 / 6
glibc
1822
musl
1822
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18226 runs
build_error
glibc
node 18226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

SSH2Stream
const { SSH2Stream } = require('ssh2-streams');
import { SSH2Stream } from 'ssh2-streams';
Primary export via CommonJS `require`. Direct ESM `import` is not supported without transpilation or Node.js CJS interop for default exports.
SFTPStream
const { SFTPStream } = require('ssh2-streams');
import { SFTPStream } from 'ssh2-streams';
Similar to SSH2Stream, this is a named CommonJS export representing the SFTPv3 protocol stream.
utils
const { utils } = require('ssh2-streams');
import { utils } from 'ssh2-streams';
Contains helper functions, such as `fingerprint` for generating host key fingerprints.
constants
const { constants } = require('ssh2-streams');
import { constants } from 'ssh2-streams';
Provides SSH protocol constants for various message types, reason codes, and channel types.

This quickstart initializes an SSH2Stream, attaches essential event listeners for protocol observation, and demonstrates basic utility usage. It clarifies that the stream requires a `net.Socket` for actual network communication.

const { SSH2Stream, utils, constants } = require('ssh2-streams'); const net = require('net'); // This quickstart demonstrates how to initialize an SSH2Stream and set up // basic event listeners to observe the SSH protocol negotiation. // In a real-world scenario, you would pipe a connected net.Socket instance // to this SSH2Stream to process the raw SSH protocol bytes. // ssh2-streams itself does not handle the network connection. const stream = new SSH2Stream(); // Listen for the initial SSH protocol header from the remote party stream.on('header', (headerInfo) => { console.log('SSH Header Received:', headerInfo); console.log(`Remote software: ${headerInfo.versions.software}`); // A real client would send its own header back: stream.write(Buffer.from('SSH-2.0-MyClient\r\n')); }); // This event is crucial for host key verification in client implementations. // The default behavior is to auto-allow any host key if no handler is present. stream.on('fingerprint', (hostKeyBuffer, callback) => { const finger = utils.fingerprint(hostKeyBuffer); console.log('Received Host Key Fingerprint:', finger); // In a production client, you'd compare 'finger' to known_hosts. // For this example, we unconditionally accept the host key. callback(true); }); // Event for when new encryption keys have been exchanged stream.on('NEWKEYS', () => { console.log('New encryption keys have been successfully exchanged.'); // After NEWKEYS, authentication can begin. }); // Handle general errors that might occur within the stream processing stream.on('error', (err) => { console.error('SSHStream encountered an error:', err.message); }); // Listen for a disconnect message from the remote party stream.on('DISCONNECT', (reason, reasonCode, description) => { console.warn(`Disconnected by remote: [${reasonCode}] ${reason} - ${description}`); }); console.log('SSH2Stream initialized. Attach a net.Socket to this stream to start protocol communication.'); console.log('Example of using utilities: SHA256 fingerprint for a dummy key:', utils.fingerprint(Buffer.from('-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs...-----END PUBLIC KEY-----'))); console.log('Example protocol constant:', `Disconnect Reason: ${constants.DISCONNECT_REASON_CODE_NAMES[constants.DISCONNECT_REASON.HOST_NOT_ALLOWED_TO_CONNECT]}`); // To make this quickstart runnable, you would pipe a connected net.Socket to the stream: /* const clientSocket = net.connect(22, 'localhost', () => { clientSocket.pipe(stream).pipe(clientSocket); // stream.write(...) would send data over the SSH protocol. }); */
Debug
Known issues
gotchaBy default, if no 'fingerprint' event handler is registered, ssh2-streams will automatically accept any host key presented by the remote server. This behavior is insecure for production client applications as it bypasses host authenticity verification.
fix
Always implement a `stream.on('fingerprint', (hostKey, callback) => { ... })` handler in client code to verify the host key against known records (e.g., `~/.ssh/known_hosts`) and call `callback(true)` only if verified.
affects: >=0.1.0
gotchassh2-streams is a low-level protocol implementation. It does not handle the underlying network connection (e.g., TCP sockets) itself. Developers must establish and manage the `net.Socket` and pipe it to the `SSH2Stream` for communication.
fix
Ensure you create and manage a `net.Socket` (or similar network stream) and correctly pipe data between the socket and the `SSH2Stream` instance. Example: `socket.pipe(sshStream).pipe(socket);`
affects: >=0.1.0
gotchaAs a Node.js stream, proper backpressure handling is crucial to prevent memory exhaustion and ensure stable performance, especially when dealing with large data transfers over SSH channels. Neglecting backpressure can lead to 'write after end' errors or process crashes.
fix
Implement proper backpressure control mechanisms when reading from and writing to the stream, using `stream.pause()`, `stream.resume()`, and monitoring return values of `stream.write()` to buffer data appropriately.
affects: >=0.1.0
gotchaError handling in stream-based protocols can be complex, as errors can originate from the underlying socket, the stream parsing logic, or the SSH protocol itself (e.g., channel errors, disconnect messages). Not all error types are emitted as standard 'error' events.
fix
Listen for the generic `stream.on('error', (err) => { ... })` event for parser/stream-level issues, but also specific protocol events like `DISCONNECT`, `CHANNEL_OPEN_FAILURE`, etc., to gracefully handle protocol-level errors.
affects: >=0.1.0
Errors
Common errors & fixes
TypeError: Class constructor SSH2Stream cannot be invoked without 'new'
Attempting to call `SSH2Stream()` as a function instead of a constructor.
fix
Always instantiate `SSH2Stream` using the `new` keyword: `const stream = new SSH2Stream();`
Error: stream.push() after EOF
Attempting to write data to a Node.js stream after it has signaled its end (e.g., via `stream.end()` or remote disconnect).
fix
Ensure no data is written to the stream after it has ended or been closed. Check stream state before writing, or handle 'close' and 'end' events to prevent further writes.
Error: Packetizer exceeded max buffer size
The internal buffer for reassembling SSH packets has grown too large, indicating a potential protocol desynchronization or an attempt to send/receive an unusually large malformed packet.
fix
This often points to a protocol-level issue. Review the data flow, ensure correct packet boundaries, and potentially increase the maximum buffer size if legitimately handling extremely large SSH packets (though usually, this indicates an underlying problem).
TypeError: require(...).SSH2Stream is not a constructor
The `require()` call did not correctly extract the `SSH2Stream` constructor, or the `ssh2-streams` package might not be correctly installed or resolved.
fix
Ensure `ssh2-streams` is installed (`npm install ssh2-streams`) and that you are correctly destructuring the named export: `const { SSH2Stream } = require('ssh2-streams');`.
Upgrade
Version history
0.4.10latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
19 hits · last 30 days
node
14
OpenAI (training)
1
Resources
ssh2-streams — npm install ssh2-streams · libregistry