Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A thin minimal wrapped around http|https NodeJS module for NodeJS and browser.
A thin minimal wrapped around http|https NodeJS module for NodeJS and Browser.
bfet supports sending GET
and POST
request method for both HTTP and HTTPS with an option to parse response as JSON or just simple string. Support Promise as return. It has internal caching system for GET request and you can enable or disable it.
Only target url that supports CORS will work on browser, otherwise it will return error accordingly. There should be no problem on NodeJS.
Install it via npm install bfet
bfet.get("https://targetdomain.com")
.then((result) => {
// actual result data: result.response
// response's HTTP headers: result.responseHeaders
}, (e) => {
// error code and message: e.code and e.message
// response's HTTP headers: e.responseHeaders
});
bfet.get("https://targetdomain.com")
bfet.get("https://targetdomain.com?myanswer=1")
bfet.get("https://targetdomain.com", { myanswer: 1 })
bfet.get("https://targetdomain.com", { myanswer: 1 }, { json_parse: false })
bfet.get("https://targetdomain.com", { myanswer: 1 }, { username: "myusername", password: "mypassword" })
bfet.get("https://targetdomain.com",
{ myanswer: 1 },
{
username: "myusername",
password: "mypassword",
headers: {
'If-None-Match': '"d751713988987e9331980363e24189ce"'
}
})
bfet.post("https://targetdomain.com", { myanswer: 1 })
bfet.post("https://targetdomain.com", { myanswer: 1 }, { json_parse: false })
bfet.post("https://targetdomain.com", { myanswer: 1 }, { username: "myusername", password: "mypassword" })
By default, it's enabled with internal caching for GET request.
It makes much more sense to cache only GET request as almost for POST request, it's just an acknowledge short response that user has successfully updated or created new resource. GET request is more likely to be dynamically changed, and larger in size.
bfet allows user to manually handle caching without relying on internal system although this would achieve the same result.
See the following code
bfet.global.options.enableCaching = false;
var etag;
var cachedItem;
// make a first request
bfet.get(url)
.then((r1) => {
// save cached item
// normally users handle cached item here
cachedItem = r1.response;
// save etag
etag = r1.responseHeaders.etag;
// 2nd request
bfet.get(url, null, {
headers: {
'If-None-Match': etag
}
}).then((r2) => {
// if cache hit, this line should not be reached
}, (e2) => {
// e2.code = 304 indicates that resource is not modified
// feel free to grab local resource and use it via cachedItem as we saved eariler
});
}, (e1) => {
// handle error for first request
});
Concept is as follows
bfet.global.options.enableCaching
If-None-Match
or If-Modified-Since
.304
.You have following options to set for your request.
json_parse
- Boolean
- Default is true
, you can set to false
to not parse the result you get.username
- String
- If target URL needs basic authorization, you can set username here.password
- String
- If target URl needs basic authorization, you can set password here.headers
- Object
- Headers as object for additional headers to be sent along with the request.bfet has global options which if configured will affect the whole system
bfet.global.options.enableCaching
- enable/disable internal caching, pretty much relates to HTTP 304 status codenpm run build
- to create a bundle files in ./dist
directorynpm test
- to run tests for both NodeJS and browsernpm run http-and-watch
- to build, start local http-server and watch changes on file for live reloadingThis project is based on basejit
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License
FAQs
A thin minimal wrapped around http|https NodeJS module for NodeJS and browser.
The npm package bfet receives a total of 1 weekly downloads. As such, bfet popularity was classified as not popular.
We found that bfet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.