
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@feedthrough/sveltekit
Advanced tools
feedthrough.dev · npm · GitHub
SvelteKit adapter for Feedthrough. Injects the browser bridge into every server-rendered page during development so an AI agent can observe console logs, network requests, and DOM state in real time.
npm install --save-dev @feedthrough/sveltekit
Add feedthroughHandle (or the result of setupFeedthrough()) to your hooks.server.ts:
// src/hooks.server.ts
import { feedthroughHandle } from "@feedthrough/sveltekit";
import { sequence } from "@sveltejs/kit/hooks";
export const handle = sequence(feedthroughHandle);
If you have other handles, include them in the sequence call. Feedthrough is a no-op outside
NODE_ENV=development, so it is safe to leave wired in across all environments.
import { setupFeedthrough } from "@feedthrough/sveltekit";
export const handle = sequence(setupFeedthrough({ port: 8765 }));
# Terminal 1 — app
npx vite dev
# Terminal 2 — MCP server
npx @feedthrough/mcp
Then connect your AI agent (Claude Code, Cursor, or any other MCP client) to the server and
use connection_status, get_console_logs, query_dom, etc.
The adapter exports a SvelteKit Handle function that uses resolve(event, { transformPageChunk })
to inject the Feedthrough IIFE bridge into the <head> of every HTML response. The bridge
script is embedded at build time — there are no runtime fetches from the adapter itself.
The guard process.env.NODE_ENV !== "development" means the handle is a transparent pass-through
in production builds.
FAQs
Unknown package
We found that @feedthrough/sveltekit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.