
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@llm-eaf/node-event-source
Advanced tools
A better API for making Event Source requests (SSE) in Node.js, with all the features of axios.
This library was inspired by and includes some code from @microsoft/fetch-event-source. We are grateful to the author and contributors of that library.
This library offers an enhanced API for making Event Source requests, also known as server-sent events, incorporating all the features available in the Axios API for use within a Node.js environment.
The default browser EventSource API imposes several restrictions on the type of request you're allowed to make: the only parameters you're allowed to pass in are the url and withCredentials, so:
This library provides an alternate interface for consuming server-sent events, based on the Axios API. It is fully compatible with the Event Stream format, so if you already have a server emitting these events, you can consume it just like before. However, you now have greater control over the request and response so:
responseType and validateStatus.npm install @llm-eaf/node-event-source
import { nodeEventSource } from "@llm-eaf/node-event-source";
await nodeEventSource("/api/sse", {
onMessage(ev) {
console.log(ev.data);
},
});
If your server not response with text/event-stream Content-Type, please use your own onOpen callBack.
import { nodeEventSource } from "@llm-eaf/node-event-source";
await nodeEventSource("/api/sse", {
onOpen(response) {
},
onMessage(ev) {
console.log(ev.data);
},
});
You can pass in all the other parameters except responseType and validateStatus exposed by the default axios API, for example:
const ctrl = new AbortController();
nodeEventSource("/api/sse", {
method: "POST",
headers: {
"Content-Type": "application/json",
},
body: {
foo: "bar",
},
signal: ctrl.signal,
});
You can add better error handling, for example:
class FatalError extends Error {}
nodeEventSource("/api/sse", {
async onopen(response) {
},
onMessage(msg) {
// if the server emits an error message, throw an exception
// so it gets handled by the onerror callback below:
if (msg.event === "FatalError") {
throw new FatalError(msg.data);
}
},
onError(err) {
if (err instanceof FatalError) {
throw err; // rethrow to stop the operation
} else if (err instanceof NodeEventSourceError) {
switch (err.type) {
case NodeEventSourceErrorType.Request:
const axiosError = err.origin as AxiosError;
// you can handle the axios error here https://axios-http.com/docs/handling_errors
break;
case NodeEventSourceErrorType.Other:
break;
default:
break;
}
} else {
console.error(err);
}
// return true to retry.
},
});
FAQs
A better API for making Event Source requests (SSE) in Node.js, with all the features of axios.
The npm package @llm-eaf/node-event-source receives a total of 3 weekly downloads. As such, @llm-eaf/node-event-source popularity was classified as not popular.
We found that @llm-eaf/node-event-source demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.