
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
axios-userscript-adapter
Advanced tools
An adapter for axios to make ajax calls within UserScript via the GM.xmlHttpRequest function as provided by the Greasemonkey and Tampermonkey WebExtensions for Firefox and Chromium-based browsers.
// ==UserScript==
// @name new user script
// @namespace https://trim21.me/
// @description hello
// @version 0.0.1
// @author Trim21 <trim21me@gmail.com>
// @match http*://*/*
// @require https://cdn.jsdelivr.net/npm/axios@v1.0.0-alpha.1/dist/axios.min.js
// @require https://cdn.jsdelivr.net/npm/axios-userscript-adapter@0.2.0-alpha.2
// @grant GM.xmlHttpRequest
// @run-at document-end
// @connect httpbin.org
// ==/UserScript==
console.log(axios.defaults.adapter);
axios.defaults.adapter = axiosGmxhrAdapter;
axios.get("https://httpbin.org/headers").then((res) => console.log(res.data));
The axios documentation describes axios adapters as
modules that handle dispatching a request and settling a returned Promise once a response is received.
The standard axios distribution includes adapters for the browser via xmlHttpRequest, and node.js via http and https.
Custom adapters are typically used for 'mocking' requests for testing purposes, such as axios-mock-adapter.
axios-userscript-adapter is specifically for using axios in the browser.
Chiefly, in userscript where the xmlHttpRequest function for making ajax requests is replaced with GM.xmlHttpRequest.
GM.xmlHttpRequest is a privileged function available within the Greasemonkey and Tampermonkey
webextensions that allow userscripts to make ajax requests that cross same origin policy boundaries.
In other words, using axios, the userscript can make http requests to sites that didn't originate from the currently loaded web page.
Read the GM.xmlHttpRequest function wiki page for further details.
After assigning axios-userscript-adapter as the default adapter:
var axios = require("axios");
var adapter = require("axios-userscript-adapter");
axios.defaults.adapter = adapter;
all the usual axios goodness is available within your userscript.
axios-userscript-adapter requires axios 0.21.0 or higher
add // @grant GM.xmlHttpRequest to your userscript metadata
If you are using older version, you may grant GM_xmlhttpRequest
npm install axios axios-userscript-adapter
As previously shown, you can set axios-userscript-adapter as the default adapter,
in which case, all axios requests will be dispatched via GM.xmlHttpRequest.
However, you can instead specify the adapter on individual requests via a config object.
console.log(axios.defaults.adapter);
axios.defaults.adapter = axiosGmxhrAdapter;
axios.get("https://httpbin.org/headers");
Example with webpack:
var axios = require("axios");
var adapter = require("axios-userscript-adapter");
// Send a POST request using GM.xmlHttpRequest
axios({
method: "post",
url: "https://www.different-server.com/user/12345",
data: {
firstName: "Fred",
lastName: "Flintstone",
},
adapter: adapter,
});
or via any requests made by an instance:
var axios = require("axios");
var adapter = require("axios-userscript-adapter");
var instance = axios.create({
// `url` is the server URL that will be used for the request
url: "https://www.different-server.com/user",
// `method` is the request method to be used when making the request
method: "post",
// `adapter` allows custom handling of requests which makes testing easier.
// Return a promise and supply a valid response.
adapter: adapter,
});
// Send a POST request using GM.xmlHttpRequest
instance.request({
data: {
firstName: "Fred",
lastName: "Flintstone",
},
});
esm is also supported:
import adapter from "axios-userscript-adapter";
axios-userscript-adapter is forked from axios-gmxhr-adapter
MIT
FAQs
GM.xmlHttpRequest adapter for Axios HTTP client
The npm package axios-userscript-adapter receives a total of 67 weekly downloads. As such, axios-userscript-adapter popularity was classified as not popular.
We found that axios-userscript-adapter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.