
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@sifrr/fetch
Advanced tools
Fetch API and websockets API based small, easy to use, promise based requests library for browsers.
Type | Size |
---|---|
Minified (dist/sifrr.fetch.min.js ) | |
Minified + Gzipped (dist/sifrr.fetch.min.js ) |
Add script tag in your website.
<script src="https://unpkg.com/@sifrr/fetch@{version}/dist/sifrr.fetch.min.js"></script>
APIs | caniuse | polyfills |
---|---|---|
Fetch API | https://caniuse.com/#feat=fetch | https://github.com/github/fetch |
Promises API | https://caniuse.com/#feat=promises | https://github.com/stefanpenner/es6-promise |
Do npm i @sifrr/fetch
or yarn add @sifrr/fetch
or add the package to your package.json
file.
example, put in your frontend js module (compatible with webpack/rollup/etc):
window.Sifrr = window.Sifrr || {};
window.Sifrr.Fetch = require('@sifrr/fetch');
import Fetch from '@sifrr/fetch';
// or
import { Fetch, Socket } from '@sifrr/fetch';
// and use as Sifrr.Fetch or Sifrr.Fetch.Socket
// set global.fetch
global.fetch = require('node-fetch);
const { Fetch } = require('@sifrr/fetch');
// use SFetch.get, post etc,
global.WebSocket = require('isomorphic-ws');
const { Socket } = require('@sifrr/fetch');
Note: You can not use websockets with node
options are Fetch API options with some extra keys:
json object
key, value pairs will be added to url as ?key=valuejson object | string
body to send with post requestsfunction
if response has content-length, this function will be called with{
loaded, // loaded bytes
total, // total bytes (0 if response doesn't have content length)
percent, // progress precentage
speed, // speed in kbps
value,
... // chunk value
}
time in ms
timeout for requestfunction
this function will be called with { url, options, method }
and should return modified { url, options, method }
which will be used to send requestsfunction
this function will be called with response
and should return modified response
function
this function will be called with { url, options, method }
and resolve/return with response which will be returned, if this function errors, response will be fetched normally (use case: use it as a middleware for cache)you can add query parameters to get request options.
options.query = { key: 'value' };
Sifrr.Fetch.get(url, options)
.then(response => {
// This will send request to url?key=value
// response is JSON if response has `content-type: application/json` header
// else it is a Fetch API response object.
})
.catch(e => {
// handle error, same for other type of requests
});
Sifrr.Fetch.put(url, options).then(response => {
// response is JSON if response has `content-type: application/json` header
// else it is a Fetch API response object.
});
you can add post request body parameters to post request options.
options.body = { key: 'value' };
options.headers = {
'content-type': 'aaplication/json'
};
Sifrr.Fetch.post(url, options).then(response => {
// response is JSON if response has `content-type: application/json` header
// else it is a Fetch API response object.
});
Sifrr.Fetch.delete(url, options).then(response => {
// response is JSON if response has `content-type: application/json` header
// else it is a Fetch API response object.
});
Sifrr.Fetch.file(url, options).then(response => {
// response is a Fetch API response object.
// You can get file text content using response.text() or other fetch response methods
});
graphql request is a POST request.
Sifrr.Fetch.graphql(url, {
query: 'graphql query string',
variables: { a: 'b' },
...otherOptions
}).then(response => {
// response is JSON if response has `content-type: application/json` header
// else it is a Fetch API response object.
});
const storage = new Sifrr.Storage();
function cacheOrGet(url) {
Sifrr.Fetch.get(url, {
use: url =>
storage.get(url).then(v => (typeof v[url] === 'undefined' ? throw 'Not found' : v[url])),
after: response => {
storage.set(url, response);
return response;
}
});
}
const fetch = new Sifrr.Fetch(defaultOptions);
// then use
fetch.get;
fetch.put;
fetch.post;
fetch.delete;
fetch.graphql;
Automatic connection retries, calls fallback on message sending failure/error
Note: Only works with JSON messages/responses
// Open a socket
const socket = new Sifrr.Fetch.Socket(url, protocols, fallback /* (message) => 'fallback response' */);
// send a message
socket.send(message [, type]).then(resp => {
// do something
});
// Server will receive data as:
// {
// id: Int,
// type: type, (default: 'sifrr-fetch')
// payload: message
// },
// and should send back
// {
// id: same id as received
// payload: response
// }
// then resp will be equal to response sent above
//
// If socket connection fails
// It will call fallback function with message and resolves with its return value
socket.graphql({
query: ...,
variables: ...
}).then(data => {
// do something with data
});
let subscriptionId;
// subscribe
socket.subscribe({ query: `subscription { ... }`, variables: { ... } }, callback).then(id => subscriptionId = id);
// callback will be called with every data received from server
// unsubscribe
socket.unsubscribe(subscriptionId).then(...);
// Open a socket
const socket = new Sifrr.Fetch.Socket(
url,
protocols,
fallback /* (message) => 'fallback response' */
);
// send a message
socket.sendRaw(message);
// same as websocket's hooks
socket.onmessage = event => {};
socker.onopen = () => {};
socker.onclose = () => {};
socker.onerror = e => {};
FAQs
Fetch based http requests library for browsers.
We found that @sifrr/fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.