
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@symbux/turbo
Advanced tools
Turbo is a powerful command engine with extendability in mind, with built-in HTTP/WebSocket services.
The Turbo engine is a command-based framework for building API (and web) based applications using either built-in plugins or community/custom ones.
Package is in alpha, use at own risk.
We have created a boilerplate/starter project with a frontend and backend pre-configured and ready to use, including a docker-compose file for a single node clustered MongoDB instance for development, available here: https://github.com/Symbux/Turbo-Starter
With Yarn:
yarn add @symbux/turbo
With NPM:
npm install --save @symbux/turbo
You can find the documentation here.
import { Engine, HttpPlugin, WsPlugin } from '@symbux/turbo';
// Initialise engine instance.
const engine = new Engine({
autowire: true,
});
// Use the http plugin.
engine.use(new HttpPlugin({
port: 8080,
}));
engine.use(new WsPlugin());
// Start engine.
engine.start().catch((err) => {
console.error(err);
});
Turbo comes with tons of great features and core plugins out of the box including Http and WebSocket plugins for running servers for both.
A list of available features:
| Feature | Description |
|---|---|
| Controllers | Controllers are used to handle requests from a service, with the ability to use the same controller to serve many services. |
| Middleware | Middleware can be applied to controllers for authentication and authorization validation, like managing CORS, or IP blacklisting, alongside checking a token/login status for a user. |
| Autowire | The engine offers built-in autowiring for framework modules, like plugins, controllers, fibres, providers, tasks, and more. |
| Plugins | Plugins are used to extend the engine with new functionality, like adding new services (i.e. Discord bots), or more generic functionality. |
| Tasks | Tasks are used to run tasks based on a cron-style syntax, these can be used to run tasks on a schedule, or to run tasks as needed. |
| Fibres | Fibres are classes, that proxy exposed methods into a thread, allowing them to run in parallel but also freeing up your main thread for running intensive operations. |
| Authentication | Built in authentication decorators can be applied to a controller method to do checks against middleware set authentication data. |
| Registry | The engine provides a registry for storing data, this can be used to store data in memory, alongside the registry stores all modules that have been loaded into the engine. |
| ORM | We have opted for using an existing ORM, specifically we have decided to use Prisma, which has extremely good TypeScript support, the Turbo engine will initialise any prisma schema available, see the Turbo Starter project for a handy getting started guide. |
| Services | Services are classes that provide a service which can call controllers, and methods to run business logic, for example the HttpPlugin comes with a HttpService that sets up and manages an Express application, usually we suggest setting services up as plugins, see the source code src/plugin/http as an example. |
| Translations (i18n) | This feature allows you to support the default Accept-Language header to support manual and auto-translation of your content. |
| Plugin | Description | Type |
|---|---|---|
| HTTP Plugin | The built-in HTTP plugin is based off of Express. | built-in |
| WS Plugin | The built-in WS plugin is based off of Express-WS, will initialise an express server if the HttpPlugin is not initialised. | built-in |
| Turbo Discord | A discord plugin, that offers SSO (single sign on) to discord with built-in bot support using the new slash commands functionality with various helpers and full controller structure support. | external |
| Turbo Vite | A vite plugin for Turbo that supports server-side rendering (SSR) and full support for the Vite dev server including HMR. | external |
FAQs
Turbo is a powerful command engine with extendability in mind, with built-in HTTP/WebSocket services.
We found that @symbux/turbo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.