
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@smithy/fetch-http-handler
Advanced tools
This is the default requestHandler used for browser applications.
Since Node.js introduced experimental Web Streams API in v16.5.0 and made it stable in v21.0.0,
you can consider using fetch-http-handler in Node.js, although it's not recommended.
For the Node.js default requestHandler implementation, see instead
@smithy/node-http-handler.
Axios is a popular promise-based HTTP client for the browser and Node.js. It provides a simple API for making HTTP requests and handling responses. Compared to @smithy/fetch-http-handler, Axios offers more features out of the box, such as request and response interceptors, automatic JSON data transformation, and support for older browsers.
Node-fetch is a lightweight module that brings the Fetch API to Node.js. It is similar to @smithy/fetch-http-handler in that it uses the Fetch API for making HTTP requests. However, node-fetch is more focused on providing a minimal implementation of the Fetch API for Node.js environments, whereas @smithy/fetch-http-handler is designed to integrate with the AWS SDK for JavaScript v3.
Got is a human-friendly and powerful HTTP request library for Node.js. It supports promises, streams, retries, and many other features. Compared to @smithy/fetch-http-handler, Got offers a more extensive set of features and a more user-friendly API for making HTTP requests and handling responses.
FAQs
Provides a way to make requests
The npm package @smithy/fetch-http-handler receives a total of 33,747,343 weekly downloads. As such, @smithy/fetch-http-handler popularity was classified as popular.
We found that @smithy/fetch-http-handler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.