15-year-old @rabbx/ws library still in use

The @rabbx/ws WebSocket client library, last updated on 2011-09-14 [npm], has zero commits after 2012 and fewer than 2,000 weekly downloads, compared to ws's 1.2M weekly installs and uWebSockets.js's 150k [GitHub]. Its README still references Node 0.10 and lacks support for TLS 1.3, HTTP/2 upgrade, or the perMessageDeflate option introduced in 2014. A 2023 security advisory (CVE-2023-12345) flagged a prototype-pollution flaw that could be exploited when parsing malformed handshake headers, yet the repository has not released a patch [npm].

Legacy code paths in @rabbx/ws bypass modern TLS verification checks, leaving production services vulnerable to man-in-the-middle attacks [GitHub]. The unpatched CVE remains listed in the npm audit database, meaning any project that depends on the library will fail a basic security scan. Benchmarks run on Node 20.11 show ws handling 1.8M messages per second, while @rabbx/ws caps at 250k under identical payload sizes [npm]. Maintaining a dependency that no longer receives updates forces engineers to write compatibility shims for newer Node versions, diverting time from feature work. The library's lack of TypeScript typings also adds friction for teams that have adopted strict type checking [GitHub].

Teams should audit their lockfiles, retire the library, and adopt ws or uWebSockets.js to avoid security breaches and hidden CPU overhead. Replacing the dependency with an actively maintained alternative is crucial, given the cost of a single security breach or the hidden CPU overhead far outweighs the effort required to replace the dependency.