Outbound traffic watch
The SDK reports the hostnames your app and its npm packages connect to, and a host never seen before becomes a finding.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
A poisoned package usually gives itself away by calling home: it reads your environment and sends it to a host your app has never talked to. Outbound traffic watch is the SDK noticing that.
What the SDK reports
With the SDK running, @shellorbit/sdk 1.2 or later records each outbound connection’s hostname, port, and protocol, and which code opened it: the npm package whose code made the call, or your app. It sends new hosts at most once a minute, and the full set once a day.
It never sends a path, a query string, a header, or a body. Only the hostname leaves your server.
Turn it off with outboundWatch: false:
import { init } from "@shellorbit/sdk";
init({ dsn: process.env.SHELLORBIT_DSN, outboundWatch: false });What raises a finding
| Window | What happens |
|---|---|
| The first 24 hours after a project first reports | The baseline: every host is recorded, nothing is raised |
| After that, a host never seen for the project | A finding: high when an npm package opened the connection, medium when your own code did |
A host seen once stays known for the project. Expect a few medium findings when you ship a feature that calls a new service; resolve them and they stay quiet.
Plans
Pro and Business raise findings. On Starter the SDK’s report is accepted and kept, and nothing is raised, so upgrading starts with a baseline already in place.
What it does not catch
It sees connections made through Node.js networking in the process the SDK runs in. It cannot see a child process, a native module that opens its own sockets, a host your app already talks to used for something new, or data sent before the SDK started.