Outbound traffic watch
The SDK reports the hostnames your app and its npm packages connect to, and a host never seen before becomes a finding.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
A poisoned package usually gives itself away by calling home: it reads your environment and sends it to a host your app has never talked to. Outbound traffic watch is the SDK noticing that.
What the SDK reports
With the SDK running, @shellorbit/sdk 1.2 or later records each outbound connection’s hostname, port, and protocol, and which code opened it: the npm package whose code made the call, or your app. It sends new hosts at most once a minute, and the full set once a day.
It never sends a path, a query string, a header, or a body. Only the hostname leaves your server.
Turn it off with outboundWatch: false:
import { init } from "@shellorbit/sdk";
init({ dsn: process.env.SHELLORBIT_DSN, outboundWatch: false });What raises a finding
| Window | What happens |
|---|---|
| The first 24 hours after a project first reports | The baseline: every host is recorded, nothing is raised |
| After that, a host never seen for the project | A finding: high when an npm package opened the connection, medium when your own code did |
A host seen once stays known for the project. Expect a few medium findings when you ship a feature that calls a new service; resolve them and they stay quiet.
Plans
Pro and Business raise findings. On Hobby and Starter the SDK’s report is accepted and kept, and nothing is raised, so upgrading starts with a baseline already in place.
What it does not catch
It sees connections made through Node.js networking in the process the SDK runs in. It cannot see a child process, a native module that opens its own sockets, a host your app already talks to used for something new, or data sent before the SDK started.