Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The 'bent' npm package is a minimalistic and efficient HTTP client for Node.js. It is designed to be simple and easy to use, providing a straightforward API for making HTTP requests. It supports promises and async/await syntax, making it a modern choice for handling HTTP requests in Node.js applications.
Making GET Requests
This feature allows you to make GET requests and automatically parse the response as JSON. The 'bent' function is configured with 'json' to handle JSON responses.
const bent = require('bent');
const getJSON = bent('json');
(async () => {
const response = await getJSON('https://api.example.com/data');
console.log(response);
})();
Making POST Requests
This feature allows you to make POST requests with a JSON payload. The 'bent' function is configured with 'POST' and 'json' to handle JSON responses and ensure a 200 status code.
const bent = require('bent');
const post = bent('POST', 'json', 200);
(async () => {
const response = await post('https://api.example.com/data', { key: 'value' });
console.log(response);
})();
Handling Different Response Types
This feature allows you to handle different response types, such as buffers for binary data. The 'bent' function is configured with 'buffer' to handle binary responses.
const bent = require('bent');
const getBuffer = bent('buffer');
(async () => {
const response = await getBuffer('https://example.com/image.png');
console.log(response);
})();
Custom Headers
This feature allows you to set custom headers for your HTTP requests. The 'bent' function is configured with 'GET', 'json', and a headers object to include an authorization token.
const bent = require('bent');
const getWithHeaders = bent('GET', 'json', { 'Authorization': 'Bearer token' });
(async () => {
const response = await getWithHeaders('https://api.example.com/data');
console.log(response);
})();
Axios is a popular promise-based HTTP client for Node.js and the browser. It provides a rich set of features, including interceptors, request and response transformation, and automatic JSON parsing. Compared to 'bent', Axios offers more advanced features and a larger community.
Node-fetch is a lightweight module that brings the Fetch API to Node.js. It is similar to 'bent' in its simplicity and ease of use, but it follows the Fetch API standard, making it familiar to developers who have used the Fetch API in the browser.
Got is a powerful and flexible HTTP request library for Node.js. It supports promises, streams, retries, and advanced configuration options. Compared to 'bent', Got offers more features and customization options, making it suitable for more complex use cases.
Functional HTTP client for Node.js and Browsers with async/await.
Incredibly small browser version built on fetch with no external dependencies or polyfills.
const bent = require('bent')
const getJSON = bent('json')
const getBuffer = bent('buffer')
let obj = await getJSON('http://site.com/json.api')
let buffer = await getBuffer('http://site.com/image.png')
As you can see, bent is a function that returns an async function.
Bent takes options which constrain what is accepted by the client. Any response that falls outside the constraints will generate an error.
You can provide these options in any order, and Bent will figure out which option is which by inspecting the option's type and content.
const post = bent('http://localhost:3000/', 'POST', 'json', 200);
const response = await post('cars/new', {name: 'bmw', wheels: 4});
If you don't set a response encoding ('json'
, 'string'
or 'buffer'
)
then the native response object will be returned after the statusCode check.
In Node.js, we also add decoding methods that match the Fetch API (.json()
,
.text()
and .arrayBuffer()
).
const bent = require('bent')
const getStream = bent('http://site.com')
let stream = await getStream('/json.api')
// status code
stream.status // 200
stream.statusCode // 200
// optionally decode
const obj = await stream.json()
// or
const str = await stream.text()
The following options are available.
'GET'
, 'PUT'
, or any other ALLCAPS string will be
used to set the HTTP method. Defaults to 'GET'
.'string'
, 'buffer'
, and
'json'
. By default, the response object/stream will be returned instead
of a decoded response. Browser returns ArrayBuffer
instead of Buffer
.200
is the only acceptable status code. When any status codes
are provided, 200
must be included explicitly in order to be acceptable.The returned async function is used for subsequent requests.
When working with Binary this library uses different types in the browser and Node.js. In Node.js all binary must be done
using the Buffer
type. In the browser you can use ArrayBuffer or any ArrayBuffer view type (UInt8Array, etc).
async request(url[, body=null, headers={}])
const bent = require('bent')
const put = bent('PUT', 201)
await put('http://site.com/upload', Buffer.from('test'))
Or
const bent = require('bent')
const put = bent('PUT', 201, 'http://site.com')
await put('/upload', Buffer.from('test'))
NOTE: If the body
is passed as an object
, it will be treated
as JSON, stringified and the Content-Type
will be set to application/json
unless already set. A common requirement is to POST using form-urlencoded
.
This will require you to set the Content-Type
header to
application/x-www-form-urlencoded
and to encode the body yourself,
perhaps using
form-urlencoded.
FAQs
Functional HTTP client for Node.js w/ async/await.
We found that bent demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.