
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@bret/http-hash-router
Advanced tools
Server route handler for http-hash
var http = require('http');
var HttpHashRouter = require('http-hash-router');
var router = HttpHashRouter();
router.set('/health', function health(req, res) {
res.end('OK');
});
var server = http.createServer(function handler(req, res) {
router(req, res, {}, onError);
function onError(err) {
if (err) {
// use your own custom error serialization.
res.statusCode = err.statusCode || 500;
res.end(err.message);
}
}
});
server.listen(3000);
var router = HttpHashRouter()type NotFoundError : Error & {
type: "http-hash-router.not-found",
statusCode: 404
}
type Router : {
set: (pattern: String, handler: Function | Object) => void
} & (
req: HttpReqest,
res: HttpResponse,
opts: Object,
cb: Callback<NotFoundError | Error, void>
) => void
http-hash-router : () => Router
HttpHashRouter will create a new router function.
The HttpHashRouter itself takes no options and returns a
function that takes four arguments, req, res, opts, cb.
router(req, res, opts, cb)type NotFoundError : Error & {
type: "http-hash-router.not-found",
statusCode: 404
}
router : (
req: HttpReqest,
res: HttpResponse,
opts: Object,
cb: Callback<NotFoundError | Error, void>
) => void
http-hash-router.expected.callback exception.It is expected that you call the router function with the
HTTPRequest and HTTPResponse as the first and second
arguments.
The third argument is the options object. The router will
copy the options object and set the params and splat field.
The fourth argument is a callback function, this function
either gets called with a http-hash-router.not-found error
or gets passed to the route handler function.
If you do not pass a callback to the router function then
it will throw the http-hash-router.expected-callback exception.
router.set(pattern, handler)type RoutePattern : String
type RouteHandler : Object<method: String, RouteHandler> | (
req: HttpRequest,
res: HttpResponse,
opts: Object & {
params: Object<String, String>,
splat: String | null
},
cb: Callback<Error, void>
) => void
set : (RoutePattern, RouteHandler) => void
You can call .set() on the router and it will internally
store your handler against the pattern.
.set() takes a route pattern and a route handler. A route
handler is either a function or an object. If you use
an object then we will create a route handler function
using the http-methods module.
The .set() functionality is implemented by
http-hash itself and you can find documentation
for it at HttpHash#set.
Your handler function will get called with four arguments.
req the http request streamres the http response streamopts options object. This contains properties defined
in the server and also contains the params and splat
fields.cb callback.If your route pattern contains a param, i.e. "/foo/:bar" or
your route pattern contains a splat, i.e. "/foo/*" then
the values of the params and splat will be passed to the
params and splat field on opts.
FAQs
Server route handler for http-hash
We found that @bret/http-hash-router demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.