
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@hattip/adapter-node
Advanced tools
@hattip/adapter-nodeHattip adapter for Node.js.
import { createServer } from "@hattip/adapter-node";
import handler from "./handler.js";
createServer(handler).listen(3000, "localhost", () => {
console.log("Server listening on http://localhost:3000");
});
import { createServer } from "node:http";
import sirv from "sirv";
import { createMiddleware } from "@hattip/adapter-node";
import hattipHandler from "./entry-hattip.js";
const sirvMiddleware = sirv("public");
const hattipMiddleware = createMiddleware(hattipHandler);
createServer(
// Chain middlewares manually
(req, res) => sirvMiddleware(req, res, () => hattipMiddleware(req, res)),
).listen(3000, () => {
console.log(`Server listening on http://localhost:3000`);
});
import { createMiddleware } from "@hattip/adapter-node";
import handler from "./index.js";
import express from "express";
const app = express();
const middleware = createMiddleware(handler);
app.use(middleware);
app.listen(3000, "localhost", () => {
console.log("Server listening on http://localhost:3000");
});
/**
* Creates a request handler to be passed to http.createServer().
* It can also be used as a middleware in Express or other
* Connect-compatible frameworks).
*/
function createMiddleware(
handler: Handler,
options?: NodeAdapterOptions,
): NodeMiddleware;
/**
* Create an HTTP server
*/
function createServer(
handler: Handler,
adapterOptions?: NodeAdapterOptions,
serverOptions?: ServerOptions,
): Server;
/** Adapter options */
interface NodeAdapterOptions {
/**
* Set the origin part of the URL to a constant value.
* It defaults to `process.env.ORIGIN`. If neither is set,
* the origin is computed from the protocol and hostname.
* To determine the protocol, `req.protocol` is tried first.
* If `trustProxy` is set, `X-Forwarded-Proto` header is used.
* Otherwise, `req.socket.encrypted` is used.
* To determine the hostname, `X-Forwarded-Host`
* (if `trustProxy` is set) or `Host` header is used.
*/
origin?: string;
/**
* Whether to trust `X-Forwarded-*` headers. `X-Forwarded-Proto`
* and `X-Forwarded-Host` are used to determine the origin when
* `origin` and `process.env.ORIGIN` are not set. `X-Forwarded-For`
* is used to determine the IP address. The leftmost value is used
* if multiple values are set. Defaults to true if `process.env.TRUST_PROXY`
* is set to `1`, otherwise false.
*/
trustProxy?: boolean;
}
fetchThis adapter uses node-fetch if the fetch global is not available. You can disable this behavior by importing your adapter from @hattip/adapter-node/native-fetch, which will throw an error if fetch is not available.
context.passThrough behaviorCalling context.passThrough will pass the request to the next handler when used as a middleware. Otherwise the placeholder response will be returned.
context.platformThis adapter makes Node's native request (IncomingMessage) and response (ServerResponse) objects available in context.platform.
FAQs
Node.js adapter for Hattip
The npm package @hattip/adapter-node receives a total of 2,070 weekly downloads. As such, @hattip/adapter-node popularity was classified as popular.
We found that @hattip/adapter-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.