
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@whatwg-node/fetch
Advanced tools
@whatwg-node/fetchA ponyfill package for the Fetch Standard. If your JavaScript environment doesn't implement this standard natively, this package automatically ponyfills the missing parts, and export them as a module; otherwise it exports the native ones without touching the environment's internals. It also exports some additional standard APIs that are required by the Fetch Standard.
npm install @whatwg-node/fetch
If you are building a JavaScript library, and you want it to support all JavaScript environments not only Node.js. Fetch API is the best choice for you. Because it's a standard, and it's implemented by the most environments out there expect Node.js :). So you can use Fetch API in your library, and your users can use it in their browsers, Deno, Bun, Cloudflare Works, and in Node.js.
This is how we support all JavaScript environments in GraphQL Yoga. In GraphQL Yoga, we don't care which JavaScript environment you prefer, we support all of them.
Even if newer Node.js already implements Fetch API and Data Text Encoding API natively, we still recommend to use this package, because this package implements them for Node.js in more efficient way.
node-fetch that doesn't use undici and Node.js streams
internally, so it's more efficient than the native one.Buffer instead of the native one, because
Buffer is faster than the native one unfortunately.Body.formData() is not implemented by Node.js, so we implement it with busboy internally. So
you can consume incoming multipart(file uploads) requests with .formData in Node.js.fetch implementation of Node.js uses undici and it doesn't support HTTP 2, our implementation
supports it natively thanks to node-libcurl.If you install node-libcurl seperately, @whatwg-node/fetch will select libcurl instead of
node:http which is faster.
import { Request } from '@whatwg-node/fetch'
// See how you can handle file uploads with Fetch API
http.createServer(async (req, res) => {
const request = new Request(req)
const formData = await request.formData()
const file = formData.get('file')
// ...
})
If you want to limit the size of the multipart form data, you can use
createFetch. See the API section for more details.
The following are exported by this package:
createFetchcreateFetch allows you to create an API with some specific flags that are not available in the
actual API.
This is useful if you parse the multipart request bodies with .formData().
import { createFetch } from '@whatwg-node/fetch'
const fetchAPI = createFetch({
formDataLimits: {
// Maximum allowed file size (in bytes)
fileSize: 1000000,
// Maximum allowed number of files
files: 10,
// Maximum allowed size of content (operations, variables etc...)
fieldSize: 1000000,
// Maximum allowed header size for form data
headerSize: 1000000
}
})
// See how you can handle file uploads with Fetch API
http.createServer(async (req, res) => {
const request = new Request(req)
const formData = await request.formData()
const file = formData.get('file')
// ...
})
node-fetch is a lightweight module that brings `window.fetch` to Node.js. It is widely used and has a similar API to the Fetch API in browsers. Compared to @whatwg-node/fetch, node-fetch is more mature and has a larger user base.
axios is a promise-based HTTP client for Node.js and the browser. It provides a more feature-rich API compared to the Fetch API, including request and response interceptors, automatic JSON transformation, and more. It is more versatile but also more complex than @whatwg-node/fetch.
got is a human-friendly and powerful HTTP request library for Node.js. It supports many advanced features like retries, streams, and hooks. Compared to @whatwg-node/fetch, got offers more advanced features and better error handling.
FAQs
Cross Platform Smart Fetch Ponyfill
The npm package @whatwg-node/fetch receives a total of 5,329,151 weekly downloads. As such, @whatwg-node/fetch popularity was classified as popular.
We found that @whatwg-node/fetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.