
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@hapi/wreck
Advanced tools
wreck is part of the hapi ecosystem and was designed to work seamlessly with the hapi web framework and its other components (but works great on its own or with other frameworks). If you are using a different web framework and find this module useful, check out hapi – they work even better together.
Axios is a popular promise-based HTTP client for the browser and Node.js. It provides a simple and intuitive API for making HTTP requests and handling responses. Compared to @hapi/wreck, Axios has a larger community and more extensive documentation.
Node-fetch is a lightweight module that brings the Fetch API to Node.js. It is minimalistic and focuses on providing a familiar API for making HTTP requests. Compared to @hapi/wreck, node-fetch is simpler and more lightweight, but it lacks some of the advanced features like cookie management.
Request is a comprehensive and flexible HTTP client for Node.js. It supports a wide range of features, including authentication, redirects, and cookies. However, it has been deprecated in favor of more modern alternatives like Axios and node-fetch. Compared to @hapi/wreck, Request is more feature-rich but is no longer actively maintained.
FAQs
HTTP Client Utilities
The npm package @hapi/wreck receives a total of 1,544,942 weekly downloads. As such, @hapi/wreck popularity was classified as popular.
We found that @hapi/wreck demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.