
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
@humanwhocodes/proxy-fetch-server
Advanced tools
A Node.js server that uses a proxy agent to make fetch requests
If you find this useful, please consider supporting my work with a donation.
A Node.js server that uses a proxy agent to make fetch requests. Built with Hono, this server accepts POST requests with URLs to fetch through a configurable proxy.
The intended use is as a serverless function.
npm install @humanwhocodes/proxy-fetch-server
You can start the server using npx:
npx @humanwhocodes/proxy-fetch-server
The server is configured using environment variables:
http_proxy and https_proxy, allowing you to configure the proxy just for the fetch request rather than the whole process..humanwhocodes.com applies to humanwhocodes.com, www.humanwhocodes.com, newsletter.humanwhocodes.com, etc.Either FETCH_PROXY or at least one of http_proxy and https_proxy is required.
Example:
http_proxy=http://proxy.example.com:8080 \
https_proxy=http://proxy.example.com:8080 \
no_proxy=localhost,.internal.com \
PROXY_FETCH_KEY=my-secret-key \
PORT=3000 \
PROXY_TOKEN=proxy-secret \
PROXY_TOKEN_TYPE=Bearer \
npx @humanwhocodes/proxy-fetch-server
Or, using FETCH_PROXY to set both HTTP and HTTPS proxy to the same value:
FETCH_PROXY=http://proxy.example.com:8080 \
no_proxy=localhost,.internal.com \
PROXY_FETCH_KEY=my-secret-key \
PORT=3000 \
PROXY_TOKEN=proxy-secret \
PROXY_TOKEN_TYPE=Bearer \
npx @humanwhocodes/proxy-fetch-server
Send a POST request to the root endpoint (/) with:
Bearer <PROXY_FETCH_KEY> - Required only if PROXY_FETCH_KEY is configuredurl propertyExample using curl:
curl -X POST http://localhost:8080/ \
-H "Authorization: Bearer my-secret-key" \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'
The server will:
You can also use this package programmatically:
import { createApp } from "@humanwhocodes/proxy-fetch-server";
const app = createApp({
key: "my-secret-key",
httpProxy: "http://proxy.example.com:8080",
httpsProxy: "http://proxy.example.com:8080",
noProxy: ["localhost", ".internal.com"],
proxyToken: "proxy-secret",
proxyTokenType: "Bearer",
});
// Use with your preferred Node.js server adapter
Configuration options:
key (string, optional) - The expected Bearer token in the Authorization headerhttpProxy (string, conditionally required) - The proxy server to use for HTTP requestshttpsProxy (string, conditionally required) - The proxy server to use for HTTPS requestsnoProxy (string[], optional) - Array of hostnames or hostname:port entries to bypass proxyproxyToken (string, optional) - The token that the proxy expectsproxyTokenType (string, optional) - The token type prefix for the proxy (default: "Bearer")Either httpProxy or httpsProxy is required.
Copyright 2025 Nicholas C. Zakas
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
A Node.js server that uses a proxy agent to make fetch requests
We found that @humanwhocodes/proxy-fetch-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.