Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@types/busboy
Advanced tools
TypeScript definitions for busboy
@types/busboy provides TypeScript definitions for the busboy package, which is a streaming parser for HTML form data for node.js. It is particularly useful for handling file uploads.
Parsing Form Data
This code demonstrates how to use busboy to parse form data, including file uploads, from an HTTP POST request.
const Busboy = require('busboy');
const http = require('http');
http.createServer((req, res) => {
if (req.method === 'POST') {
const busboy = new Busboy({ headers: req.headers });
busboy.on('file', (fieldname, file, filename, encoding, mimetype) => {
console.log(`File [${fieldname}]: filename: ${filename}, encoding: ${encoding}, mimetype: ${mimetype}`);
file.on('data', (data) => {
console.log(`File [${fieldname}] got ${data.length} bytes`);
});
file.on('end', () => {
console.log(`File [${fieldname}] Finished`);
});
});
busboy.on('field', (fieldname, val) => {
console.log(`Field [${fieldname}]: value: ${val}`);
});
busboy.on('finish', () => {
res.writeHead(200, { 'Connection': 'close' });
res.end("That's all folks!");
});
req.pipe(busboy);
} else {
res.writeHead(404);
res.end();
}
}).listen(8000, () => {
console.log('Listening for requests');
});
Handling File Uploads
This code demonstrates how to handle file uploads using busboy by saving the uploaded files to a specified directory.
const Busboy = require('busboy');
const fs = require('fs');
const path = require('path');
const http = require('http');
http.createServer((req, res) => {
if (req.method === 'POST') {
const busboy = new Busboy({ headers: req.headers });
busboy.on('file', (fieldname, file, filename) => {
const saveTo = path.join(__dirname, 'uploads', path.basename(filename));
file.pipe(fs.createWriteStream(saveTo));
});
busboy.on('finish', () => {
res.writeHead(200, { 'Connection': 'close' });
res.end('Upload complete');
});
req.pipe(busboy);
} else {
res.writeHead(404);
res.end();
}
}).listen(8000, () => {
console.log('Listening for requests');
});
Formidable is a Node.js module for parsing form data, especially file uploads. It is similar to busboy in that it can handle file uploads and form data parsing, but it provides a higher-level API and more built-in features like file renaming and progress tracking.
Multer is a middleware for handling multipart/form-data, which is primarily used for uploading files. It is built on top of busboy and provides a simpler API for handling file uploads in Express applications. Multer is more opinionated and easier to use for common use cases compared to busboy.
Multiparty is a module for parsing multipart/form-data, which is used for file uploads. It is similar to busboy but provides a higher-level API and more features out of the box, such as handling multiple file uploads and field parsing.
npm install --save @types/busboy
This package contains type definitions for busboy (https://github.com/mscdex/busboy).
Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/busboy.
These definitions were written by Jacob Baskin, BendingBender, and Martin Badin.
FAQs
TypeScript definitions for busboy
The npm package @types/busboy receives a total of 387,280 weekly downloads. As such, @types/busboy popularity was classified as popular.
We found that @types/busboy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.