
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@sameer-j/react-fetch-event-source
Advanced tools
A better API for making Event Source requests, with all the features of fetch()
This package has been forked from the @microsoft/fetch-event-source as their owners are not active and accepting PRs anymore. I will try to keept this library as much up-to-date as possible with other PRs available on the main repo. Please beware that I don't intend to make this library compatible with nodejs backend. This is primarily for react and in future, react native.
This package provides a better API for making Event Source requests - also known as server-sent events - with all the features available in the Fetch API.
The default browser EventSource API imposes several restrictions on the type of request you're allowed to make: the only parameters you're allowed to pass in are the url and withCredentials, so:
This library provides an alternate interface for consuming server-sent events, based on the Fetch API. It is fully compatible with the Event Stream format, so if you already have a server emitting these events, you can consume it just like before. However, you now have greater control over the request and response so:
In addition, this library also plugs into the browser's Page Visibility API so the connection closes if the document is hidden (e.g., the user minimizes the window), and automatically retries with the last event ID when it becomes visible again. This reduces the load on your server by not having open connections unnecessarily (but you can opt out of this behavior if you want.)
npm install @sameer-j/reacfetch-event-source
// BEFORE:
const sse = new EventSource("/api/sse");
sse.onmessage = (ev) => {
console.log(ev.data);
};
// AFTER:
import { fetchEventSource } from "@sameer-j/react-fetch-event-source";
await fetchEventSource("/api/sse", {
onmessage(ev) {
console.log(ev.data);
},
});
You can pass in all the other parameters exposed by the default fetch API, for example:
const ctrl = new AbortController();
fetchEventSource("/api/sse", {
method: "POST",
headers: {
"Content-Type": "application/json",
},
body: JSON.stringify({
foo: "bar",
}),
signal: ctrl.signal,
});
You can add better error handling, for example:
class RetriableError extends Error {}
class FatalError extends Error {}
fetchEventSource("/api/sse", {
async onopen(response) {
if (
response.ok &&
response.headers.get("content-type") === EventStreamContentType
) {
return; // everything's good
} else if (
response.status >= 400 &&
response.status < 500 &&
response.status !== 429
) {
// client-side errors are usually non-retriable:
throw new FatalError();
} else {
throw new RetriableError();
}
},
onmessage(msg) {
// if the server emits an error message, throw an exception
// so it gets handled by the onerror callback below:
if (msg.event === "FatalError") {
throw new FatalError(msg.data);
}
},
onclose() {
// if the server closes the connection unexpectedly, retry:
throw new RetriableError();
},
onerror(err) {
if (err instanceof FatalError) {
throw err; // rethrow to stop the operation
} else {
// do nothing to automatically retry. You can also
// return a specific retry interval here.
}
},
});
This library is written in typescript and targets ES2017 features supported by all evergreen browsers (Chrome, Firefox, Safari, Edge.) You might need to polyfill TextDecoder for old Edge (versions < 79), though:
require("fast-text-encoding");
FAQs
A better API for making Event Source requests, with all the features of fetch()
The npm package @sameer-j/react-fetch-event-source receives a total of 113 weekly downloads. As such, @sameer-j/react-fetch-event-source popularity was classified as not popular.
We found that @sameer-j/react-fetch-event-source demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.