
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@trim21/gm-fetch
Advanced tools
using fetch based on GM.xmlHttpRequest in userscript.
Don't forget to add @grant GM.xmlHttpRequest and @connect in your metadata
It's not 100% same with fetch API because some security limit like cors site request doesn't exist on GM.xmlHttpRequest.
And AbortSignal is not supported very well due to the limitation of GM.xmlHttpRequest.
You can set some HTTP headers allowed by GM.xmlHttpRequest but not allowed by standard fetch API.
add this script to UserScript manager and visit https://example.com/
// ==UserScript==
// @name new user script
// @version 0.0.1
// @match https://example.com/*
// @grant GM.xmlHttpRequest
// @require https://cdn.jsdelivr.net/npm/@trim21/gm-fetch
// @run-at document-end
// @connect httpbin.org
// ==/UserScript==
(async () => {
const res = await GM_fetch("https://httpbin.org/headers", { method: "GET" });
const data = await res.json();
console.log(data);
})();
(you can't use @require https://cdn.jsdelivr.net/npm/@trim21/gm-fetch directly if you want to upload your script to GreasyFork,
you will need to specify version you want to use, for example @require https://cdn.jsdelivr.net/npm/@trim21/gm-fetch@0.1.15)
ES Module:
import GM_fetch from "@trim21/gm-fetch";
This package is using Request and Response class, it so requires a browser with fetch API support.
https://caniuse.com/?search=Blob.stream
MIT
FAQs
fetch for UserScript
The npm package @trim21/gm-fetch receives a total of 538 weekly downloads. As such, @trim21/gm-fetch popularity was classified as not popular.
We found that @trim21/gm-fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.