Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
alchemist-middleware
Advanced tools
Procuring static files since 1802.
Note: This project is in early development, and versioning is a little different. Read this for more details.
So there are already a number of pieces of middleware intended for serving static files. The difference with alchemist is that this one is intended only for serving static files. The main difference is that when a file is not found, it throws an error rather than just passing the request on. This is because when you are serving a static site, a 404 is not recoverable, other than by an error page.
This module is a light wrapper over send, that has static-style error handling.
npm install alchemist-middleware
Alchemist's API was designed to be quite straightforward to use. Here's a quick example:
var http = require('http'),
connect = require('connect'),
alchemist = require('alchemist-middleware');
var app = connect().use(alchemist('public'));
http.createServer(app).listen(1111);
There are a few options you can use to configure alchemist's behavior. An example is shown below with all the options filled out as their default values:
alchemist('public', {
etag: true, // toggle etag generation
hidden: false, // toggle serving of hidden/dotfiles
index: 'index.html', // directory index filename, string or false
maxage: 0 // max age in ms for http cacheing
});
FAQs
Procuring static files since 1802
The npm package alchemist-middleware receives a total of 12 weekly downloads. As such, alchemist-middleware popularity was classified as not popular.
We found that alchemist-middleware demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.