
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@prefab-cloud/prefab-cloud-node
Advanced tools
Prefab Node.js client
Install the client
npm install @prefab-cloud/prefab-cloud-node or yarn add @prefab-cloud/prefab-cloud-node
This library requires the long package to handle 64-bit integers properly:
npm install long
# or
yarn add long
Important: The
longpackage must be directly installed in your project. Some environments (particularly Heroku) require this dependency to be in your project's direct dependencies for proper module resolution. Without it, you may encounter issues with integer values being parsed incorrectly.
Set up a Prefab client.
import { Prefab } from "@prefab-cloud/prefab-cloud-node";
if (!process.env.PREFAB_API_KEY) {
throw new Error("PREFAB_API_KEY is not set");
}
const prefab = new Prefab({
apiKey: process.env.PREFAB_API_KEY,
enableSSE: true,
enablePolling: true,
});
await prefab.init();
After the init completes you can use
prefab.get('some.config.name') returns a raw valueprefab.isFeatureEnabled('some.feature.name') returns true or falseprefab.shouldLog({loggerName, desiredLevel, defaultLevel, contexts}) returns true or falsePrefab supports context for intelligent rule-based evaluation of get and isFeatureEnabled based on the current request/device/user/etc.
Given
const context = new Map([
[
"user",
new Map([
["key", "some-unique-identifier"],
["country", "US"],
]),
],
[
"subscription",
new Map([
["key", "pro-sub"],
["plan", "pro"],
]),
],
]);
You can pass this in to each call
prefab.get('some.config.name', context, defaultValue)prefab.isFeatureEnabled('some.feature.name', context, false)Or you can set the context in a block (perhaps surrounding evaluation of a web request)
prefab.inContext(context, (pf) => {
const optionalJustInTimeContext = { ... }
console.log(pf.get("some.config.name", optionalJustInTimeContext, defaultValue))
console.log(pf.isEnabled("some.config.name", optionalJustInTimeContext, false))
})
Note that you can also provide Context as an object instead of a Map, e.g.:
{
user: {
key: "some-unique-identifier",
country: "US"
},
subscription: {
key: "pro-sub",
plan: "pro"
}
}
Besides apiKey, you can initialize new Prefab(...) with the following options
| Name | Description | Default |
|---|---|---|
| collectEvaluationSummaries | Send counts of config/flag evaluation results back to Prefab to view in web app | true |
| collectLoggerCounts | Send counts of logger usage back to Prefab to power log-levels configuration screen | true |
| contextUploadMode | Upload either context "shapes" (the names and data types your app uses in prefab contexts) or periodically send full example contexts | "periodicExample" |
| defaultLevel | Level to be used as the min-verbosity for a loggerPath if no value is configured in Prefab | "warn" |
| enableSSE | Whether or not we should listen for live changes from Prefab | true |
| enablePolling | Whether or not we should poll for changes from Prefab | false |
main branchnpm run prep to build the new versionnpm version patch to bump the version number (adjust accordingly for minor/major)npm run prep again and the working directory should be cleanmain to githubnpm publish --access public to publish the new version to npmFAQs
Feature Flags, Live Config, and Dynamic Log Levels
We found that @prefab-cloud/prefab-cloud-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.