
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@mints/request
Advanced tools
A lightweight Axios + operation wrapper with global config and toast integration
A lightweight HTTP and operation wrapper built on Axios for React/Vite projects. Supports pluggable authentication strategies, global config, toast integration, request retry after refresh, and clean async operation management.
AuthStrategy (cookie-based / token-based)memory / localStorage)toast integration (decoupled from UI)operator() helper for async request + loading + error feedbackskipAuth, skipRefresh, skipUnauthorizedHandler)useRequest for automatic requests with cancellationlogin / logout for auto token managementnpm install @mints/request axios
axiosis a peer dependency — please install it in your project.
Call setupRequest() once before using request or operator (e.g. in src/setup.ts or main.tsx):
// setup.ts
import { setupRequest, createCookieStrategy } from '@mints/request';
import { toast } from '@mints/ui'; // your own toast system
setupRequest({
baseURL: '/api',
toast: {
success: toast.success,
error: toast.error,
},
auth: createCookieStrategy({
refreshPath: '/auth/refresh',
tokenField: 'jwt', // default: "access_token"
}),
onUnauthorized: () => {
window.location.href = '/login';
},
});
createCookieStrategy stores token in memory (memoryStorage).storage (e.g. localStorageStorage) if persistence is needed.401, 419, 440.requestimport { request } from '@mints/request';
// Defaults to request.public
const users = await request('/users');
// or
const users = await request.public('/users');
// Authenticated API
const me = await request.auth('/me');
request.public(url, config) → no auth, no refresh, safe for public endpoints.request.auth(url, config) → includes auth, retries after refresh if needed.request.init(url, { soft?: boolean }) → probe request, optional soft=true skips refresh.request.reset(url) → reset probe state.operator() wrapperimport { operator, request } from '@mints/request';
const [ok, data, err] = await operator(() =>
request.auth('/users', { params: { q: 'admin' } }),
);
import { login, logout } from '@mints/request/auth';
await login(() => API.auth.login(form));
await logout(() => API.auth.logout());
useRequestimport { useRequest } from '@mints/request/react';
import { request } from '@mints/request';
function Example() {
const { loading, data, error } = useRequest(
(signal) => request.auth('/users', { signal }),
[], // deps
{ name: 'fallback' }, // optional initial value
);
if (loading) return <span>Loading...</span>;
if (error) return <span>Failed: {String(error)}</span>;
return <pre>{JSON.stringify(data, null, 2)}</pre>;
}
setupRequest(config: GlobalRequestConfig)Set global request behavior.
type GlobalRequestConfig = {
baseURL?: string;
defaultHeaders?: () => Record<string, string>;
toast?: {
success?: (msg: string) => void;
error?: (msg: string) => void;
};
onUnauthorized?: () => void;
// Authentication
auth?: AuthStrategy;
retryAfterRefresh?: number; // default 1
shouldRefreshOnStatus?: (status: number) => boolean; // default: 401, 419, 440
};
request// Callable
const data = await request('/path');
// With modes
await request.public('/path', { credentials: 'never' });
await request.auth('/secure', { noRefresh: true });
skipAuth, skipRefresh, skipUnauthorizedHandler available in config.meta.operator<T,E>(fn, config)const [ok, data, err] = await operator(() => request.auth('/api'), {
setOperating: setLoading,
});
AuthStrategyTwo built-in strategies:
import { createCookieStrategy, createTokenStrategy } from '@mints/request';
// Cookie-based (refresh via httpOnly cookie)
createCookieStrategy({ ... });
// Token-exchange (refresh via refresh_token in JS, stored in localStorage by default)
createTokenStrategy({ ... });
Both accept an optional storage parameter (memoryStorage, localStorageStorage, or custom).
useRequestfunction useRequest<T, E>(
request: (signal: AbortSignal) => Promise<T>,
deps?: React.DependencyList,
initialValue?: T,
): {
loading: boolean;
data?: T;
error: E | null;
run: () => Promise<T>;
abort: () => void;
};
request.init for probe tokenrequest.public for endpoints that don't require auth.request.auth for APIs with tokens; retries are automatic.credentials: 'always' if your backend requires withCredentials.onUnauthorized globally (redirect, logout).MIT License © 2025 mints-components
FAQs
A lightweight Axios + operation wrapper with global config and toast integration
We found that @mints/request demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.