
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@autometa/http
Advanced tools
Composable HTTP client utilities with transport adapters, fluent request builders, and batteries-included behaviors (error mapping, retries, logging, streaming).
pnpm add @autometa/http
import { http } from "@autometa/http";
const client = http().baseUrl("https://api.example.com");
const response = await client
.get("/users")
.query({ limit: 25 })
.execute();
console.log(response.status); // 200
console.log(response.body); // Parsed JSON payload
HTTPError, HTTPTransportError, HTTPSchemaValidationError) with rich metadatasharedTimeout() / timeout() with automatic abortscreateHttpLogger)stream()/asStream() without JSON parsingErrors thrown by the client expose status, request metadata, and transport details. Catch specific subclasses when you need to branch logic:
import { HTTPTransportError } from "@autometa/http";
try {
await http().get("/slow").execute();
} catch (error) {
if (error instanceof HTTPTransportError) {
console.error("Transport failure", error.transport);
}
}
await http()
.get("/flaky")
.retry(config =>
config
.maxAttempts(3)
.delay(fn => fn.exponential({ base: 100, max: 2000 }))
.shouldRetry(({ response }) => response?.status === 503)
)
.execute();
Apply timeouts without wiring your own AbortController. Timeouts compose with existing signals and respect retries:
await http()
.timeout(5000)
.get();
// combine with a per-request signal
const controller = new AbortController();
await http()
.timeout(2000)
.get({ signal: controller.signal });
Timeouts use AbortController under the hood and can be shared (sharedTimeout) or scoped per request.
Set stream() when you want the raw response stream. Transports bypass JSON parsing and validation so you can pipe the body directly:
const stream = await http()
.get("/events")
.stream()
.execute();
for await (const chunk of stream.body) {
process.stdout.write(chunk);
}
The package ships with Vitest unit suites and integration tests that exercise the fluent builder against live-like transports. Run everything with:
pnpm --filter @autometa/http test
Integration tests are the recommended place to add coverage for additional transport behaviors (such as verifying streaming support end-to-end).
FAQs
An Axios Based HTTP Client for Autometa
The npm package @autometa/http receives a total of 50 weekly downloads. As such, @autometa/http popularity was classified as not popular.
We found that @autometa/http demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.