
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@qordli/next-express
Advanced tools
A file-based routing compiler for express, inspired by Next.js.
Read this in other languages: 中文
An Express file‑system routing compiler inspired by Next.js. It scans a
convention-based directory tree under src/
and compiles it into a ready‑to‑run
Express server entry so you can quickly get:
app
directory + route.(ts|js)
API routesmiddlewares.(ts|js)
/ tail-middlewares.(ts|js)
)settings.(ts|js)
(batch app.set
calls)custom-server.(ts|js)
)This repo ships both a high‑performance Rust binary and a pure TypeScript fallback. Main CLI name:
next-express
; TS fallback compiler CLI:nexp-compiler-ts
.
# Or use any package manager you like
pnpm add -D next-express ts-morph tsup chokidar
pnpm add express
nexp-compiled/
server.ts # (generated) createServer implementation (default output)
index.ts # (generated) startup script (listen etc.)
src/
app/
user/
middlewares.ts # affects user/ subtree (runs first after entering this subtree)
health/
route.ts # /health
(group)/
stats/
route.ts # /stats (parenthesized dir is a “virtual group”, not in URL)
route.ts # / (root route)
middlewares.ts # top‑level global middlewares (app.use(...))
tail-middlewares.ts # tail / 404 / error middlewares
settings.ts # exports app.set configs
custom-server.ts # (optional) custom createServer/start logic copied verbatim
File / Pattern | Purpose |
---|---|
app/**/route.(ts|js) | Defines an API route. Export HTTP method handlers (GET/POST/PUT/DELETE/PATCH/OPTIONS/HEAD etc). |
app/**/middlewares.(ts|js) | Export array: [(req,res,next)=>{} or (err,req,res,next)=>{} ]; applies to that dir + descendants. |
middlewares.(ts|js) | Top‑level global middleware array. |
tail-middlewares.(ts|js) | Top‑level tail / 404 / error middleware array. |
settings.(ts|js) | Export: export const settings = [{ name: 'trust proxy', value: true }] . |
custom-server.(ts|js) | If present, used directly as template (must export createServer ). |
Export HTTP method functions inside route.ts
(case sensitive, matching Express):
// src/app/user/route.ts
export const GET = async (req, res) => {
res.json({ user: 'alice' });
};
export const POST = async (req, res) => {
res.status(201).send('created');
};
If a method isn't exported, requests for that method respond with 405 Method Not Allowed
.
Directories wrapped in parentheses (e.g. (group)
) exist only for organization and are removed from the URL.
src/app/(internal)/logs/route.ts
becomes /logs
.
next-express
)The compiler generates:
nexp-compiled/server.ts
(or custom server file name).next-express/index.js
(final executable entry in build/dev)Command | Description | Typical Use |
---|---|---|
dev | Dev: watch compile + auto (re)start Node process | Local development |
compile | Generate artifacts only (no bundle/minify) | Debug / post-proc |
build | Generate then bundle & minify to .next-express | Production deploy |
-v/--version | Show version | — |
Flag | Default | Description |
---|---|---|
--src-dir | src | Source directory |
--dist-dir | nexp-compiled | Intermediate compilation output (server template) |
--server | server.ts | Generated server file name (exports createServer) |
--entry | index.ts | Generated startup entry (listens on port) |
--port / -p | 3000 | Port to listen (written into entry file) |
Extra for dev
:
Flag | Default | Description |
---|---|---|
--watch | ['src'] | Directories/files to watch for changes |
# Development
npx next-express dev -p 4000
# Compile only (produce nexp-compiled/server.ts & nexp-compiled/index.ts)
npx next-express compile
# Production build (outputs .next-express/index.js)
npx next-express build
# Run bundled output
node .next-express/index.js
.next-express
.node .next-express/index.js
.Generated server.ts
looks like:
import express from 'express';
// dynamically inserted imports...
export const createServer = () => {
const app = express();
// settings, middlewares, routes, tail-middlewares injected
return app;
};
Generated entry (index.ts
):
import { createServer } from './server';
const app = createServer();
app.listen('<port>', () => {
console.log('Server is listening on <port>');
});
Place custom-server.ts
(or .js
) directly under src/
.
Required magic comments (will be replaced during compile):
/* __nextExpress_imports__ */
/* __nextExpress_settings__ */
/* __nextExpress_topLevelMiddlewares__ */
/* __nextExpress_routes__ */
/* __nextExpress_tailMiddlewares__ */
Example adding socket.io:
import express from 'express';
import { Server as SioServer } from 'socket.io';
import { createServer as CreateHttpServer } from 'http';
/* __nextExpress_imports__ */
export const createServer = () => {
const app = express();
/* __nextExpress_settings__ */
const server = CreateHttpServer(app);
const io = new SioServer(server);
io.on('connection', socket => {
console.log('New socket connection:', socket.id);
});
/* __nextExpress_topLevelMiddlewares__ */
/* __nextExpress_routes__ */
/* __nextExpress_tailMiddlewares__ */
return app;
};
If present, this file is copied and filled as the template.
If a route does not implement an HTTP method, responses return:
405 Method <METHOD> Not Allowed
Implementation snippet:
res.status(405).send(`Method ${req.method} Not Allowed`);
src/app/
.route.(ts|js)
files define terminal routes.(auth)
not auth()
.middlewares.ts
app/**/middlewares.ts
(outer → inner)tail-middlewares.ts
In tail-middlewares.ts
last element:
export const middlewares = [
(req, res) => res.status(404).send('Not Found')
];
Add an error middleware (four args) in tail-middlewares.ts
after non-error handlers:
export const middlewares = [
// ... other tail middlewares / 404
(err, req, res, next) => {
console.error(err);
res.status(500).send('Internal Server Error');
}
];
custom-server.ts
to fully take over.server.ts
in your own custom entry and layer extra logic.MIT
FAQs
A file-based routing compiler for express, inspired by Next.js.
The npm package @qordli/next-express receives a total of 24 weekly downloads. As such, @qordli/next-express popularity was classified as not popular.
We found that @qordli/next-express demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.