
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
create-bini-app
Advanced tools
Bini.js: Ultra-high-performance enterprise-grade React framework with automatic source code protection, Next.js-like file-based routing, head-only SSR, production-ready API routes, Fastify server, TypeScript support, and built-in security middleware. The
██████╗ ██╗███╗ ██╗██╗ ██╗███████╗
██╔══██╗██║████╗ ██║██║ ██║██╔════╝
██████╔╝██║██╔██╗ ██║██║ ██║███████║
██╔══██╗██║██║╚██╗██║██║ ██╗ ██║╚════██║
██████╔╝██║██║ ╚████║██║ ╚█████╔╝███████║
╚═════╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚════╝ ╚══════╝
API routes now fully support TypeScript (.ts) files alongside JavaScript, with all routes moved to src/app/api/ for a unified Next.js-compatible structure:
// src/app/api/users.ts
import type { Request, Response } from 'fastify';
interface User {
id: number;
name: string;
email: string;
createdAt: string;
}
interface CreateUserBody {
name: string;
email: string;
}
interface ApiResponse<T> {
success: boolean;
data?: T;
error?: string;
timestamp: string;
}
export default function handler(
req: Request,
res: Response
): ApiResponse<User | User[] | null> {
const timestamp = new Date().toISOString();
switch (req.method) {
case 'GET':
return {
success: true,
data: [
{ id: 1, name: 'Alice', email: 'alice@example.com', createdAt: timestamp }
],
timestamp
};
case 'POST':
const { name, email } = req.body as CreateUserBody;
if (!name || !email) {
res.status(400);
return {
success: false,
error: 'Name and email required',
timestamp
};
}
res.status(201);
return {
success: true,
data: { id: Date.now(), name, email, createdAt: timestamp },
timestamp
};
default:
res.status(405);
return { success: false, error: 'Method not allowed', timestamp };
}
}
API routes now live inside src/app/api/ alongside your pages:
src/app/
├── layout.tsx # Root layout
├── page.tsx # Home page (/)
├── about/page.tsx # /about
├── blog/[slug]/page.tsx # /blog/:slug
├── api/ # API ROUTES (NEW LOCATION)
│ ├── hello.ts # TypeScript API route
│ ├── users.ts # TypeScript API route
│ ├── products/[id].ts # Dynamic TypeScript API route
│ └── search/query.js # JavaScript API route
└── globals.css # Global styles
[id] and [...slug] patternsBuild source-code-protected React apps with Next.js-style file-based routing and built-in API routes (with full TypeScript support), powered by Vite and Fastify. Your source code stays hidden while your site remains fully functional and SEO-optimized.
Key Differentiators:
npx create-bini-app@latest my-app
cd my-app
npm install
npm run dev
Your browser opens automatically at http://localhost:3000.
npx create-bini-app@latest
Select your preferences:
# Full-featured with TypeScript and Tailwind
npx create-bini-app@latest my-app --typescript --tailwind
# With CSS Modules
npx create-bini-app@latest my-app --css-modules
# JavaScript only
npx create-bini-app@latest my-app --javascript
# Override existing directory
npx create-bini-app@latest my-app --force
# Skip automatic dependency installation
npx create-bini-app@latest my-app --skip-install
# Show detailed logs
npx create-bini-app@latest my-app --verbose
Bini.js automatically detects and uses your preferred package manager in priority order:
my-app/
├── src/
│ ├── app/ # File-based routing (Next.js-like)
│ │ ├── layout.tsx # Root layout (metadata, SEO)
│ │ ├── page.tsx # Home page (/)
│ │ ├── about/page.tsx # Static route (/about)
│ │ ├── blog/[slug]/page.tsx # Dynamic route (/blog/:slug)
│ │ ├── api/ # API routes (TypeScript & JavaScript)
│ │ │ ├── hello.ts # TypeScript API route example
│ │ │ ├── users.ts # TypeScript API route
│ │ │ ├── search/query.js # JavaScript API route
│ │ │ └── products/[id].ts # Dynamic TypeScript API route
│ │ └── globals.css # Global stylesheet + CSS variables
│ ├── App.tsx # Root component (auto-generated)
│ └── main.tsx # Application entry point
├── public/ # Static assets & auto-generated favicons
│ ├── favicon.svg # Rebranded ß icon (SVG)
│ ├── favicon.png # Main favicon (512×512)
│ ├── favicon-16x16.png # 16px resolution
│ ├── favicon-32x32.png # 32px resolution
│ ├── favicon-64x64.png # 64px resolution
│ ├── favicon-180x180.png # 180px for iOS
│ ├── favicon-512x512.png # 512px for Android
│ ├── apple-touch-icon.png # iOS home screen icon
│ ├── og-image.png # Social media preview (1200×630)
│ └── site.webmanifest # PWA manifest
├── bini/
│ ├── internal/plugins/ # Framework runtime (DO NOT EDIT)
│ │ ├── router.js # File-based routing + race condition fix
│ │ ├── api.js # API middleware + TypeScript support
│ │ ├── ssr.js # SSR meta tag injection
│ │ ├── badge.js # Dev console badge
│ │ ├── preview.js # Preview server config
│ │ └── env-checker.js # Environment file detection
│ └── bini.d.ts # TypeScript definitions
├── .bini/
│ ├── dist/ # Production build (read-only)
│ └── cache/ # Build cache
├── index.html # HTML template
├── vite.config.mjs # Vite config (imports bini.config.mjs)
├── bini.config.mjs # Bini.js configuration
├── api-server.js # ⚡ Fastify production server
├── package.json # Dependencies
├── tsconfig.json # TypeScript (if enabled)
├── tailwind.config.js # Tailwind CSS (if enabled)
├── .env.example # Environment variables template
└── README.md # Project documentation
Pages are automatically discovered and routed based on file location:
src/app/
├── page.tsx → /
├── about/page.tsx → /about
├── blog/page.tsx → /blog
├── blog/[slug]/page.tsx → /blog/:slug
└── admin/[...id]/page.tsx → /admin/* (catch-all)
Static Route:
// src/app/about/page.tsx
export default function AboutPage() {
return (
<div>
<h1>About Us</h1>
<p>Company information here.</p>
</div>
);
}
Dynamic Route:
// src/app/blog/[slug]/page.tsx
import { useParams } from 'react-router-dom';
export default function BlogPost() {
const { slug } = useParams();
return (
<article>
<h1>Post: {slug}</h1>
<p>Dynamic content for {slug}</p>
</article>
);
}
Routes are automatically generated at startup and hot-reload during development. Race conditions are prevented by the async lock system.
src/app/api/API routes now live inside the src/app/ directory alongside your pages for a cohesive, Next.js-compatible structure.
Create type-safe API routes with full TypeScript support:
// src/app/api/products/[id].ts
import type { Request, Response } from 'fastify';
interface Product {
id: string;
name: string;
price: number;
stock: number;
}
export default function handler(
req: Request,
res: Response
): { success: boolean; data?: Product; error?: string } {
const { id } = req.query;
if (req.method === 'GET') {
return {
success: true,
data: {
id: id as string,
name: `Product ${id}`,
price: 99.99,
stock: 50
}
};
}
res.status(405);
return { success: false, error: 'Method not allowed' };
}
// src/app/api/hello.js
export default function handler(req, res) {
return {
message: 'Hello from Bini.js API!',
timestamp: new Date().toISOString(),
method: req.method
};
}
// src/app/api/users.ts
export default function handler(req: Request, res: Response) {
switch (req.method) {
case 'GET':
// Fetch all users
return { users: [] };
case 'POST':
// Create new user
const { name, email } = req.body;
return { id: Date.now(), name, email, created: true };
case 'PUT':
// Update user
return { updated: true };
case 'DELETE':
// Delete user
return { deleted: true };
default:
res.status(405);
return { error: 'Method not allowed' };
}
}
// src/app/api/search.ts
export default function handler(req: Request, res: Response) {
const { q, limit = '10', offset = '0' } = req.query;
// Input sanitized automatically
return {
query: q,
limit: parseInt(limit as string),
offset: parseInt(offset as string),
results: [],
timestamp: new Date().toISOString()
};
}
export default function handler(req: Request, res: Response) {
// Request Properties
req.method // 'GET', 'POST', 'PUT', 'DELETE', 'PATCH'
req.url // Full request URL
req.headers // HTTP headers object
req.body // Parsed & sanitized JSON (POST/PUT/PATCH/DELETE)
req.query // Query parameters object (sanitized)
req.ip // Client IP address
// Response Methods
res.status(code) // Set HTTP status code
res.setHeader(name, value) // Set response header
res.json(data) // Send JSON response
res.send(data) // Send response (auto-detects format)
res.end(data) // End response with optional data
return data; // Auto-serialized to JSON (preferred)
}
| Feature | Details |
|---|---|
| Request Timeout | 30 seconds per request |
| Body Size Limit | 1MB default (configurable) |
| Rate Limiting | 100 requests per 15 minutes per IP |
| Response Format | Automatically JSON-serialized |
| Security | Path traversal prevention, prototype pollution checks, input sanitization |
| Caching | 5-minute TTL for handlers (prevents memory leaks) |
| Availability | Works in development, preview, AND production |
| Performance | 2x faster with Fastify vs Express |
| Language Support | Both TypeScript (.ts) and JavaScript (.js) |
| Hot Reload | Automatic reload in development when API files change |
| TypeScript Compilation | Automatic transpilation to JavaScript |
All API responses include rate limit information:
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1730396400
Define all SEO information in your root layout:
// src/app/layout.tsx
export const metadata = {
title: 'My Application',
description: 'High-performance React application',
keywords: ['react', 'bini', 'fastify', 'vite'],
openGraph: {
title: 'My Application',
description: 'Experience fast, modern development',
url: 'https://myapp.com',
images: [{
url: '/og-image.png',
width: 1200,
height: 630,
alt: 'My Application Preview'
}]
},
twitter: {
card: 'summary_large_image',
title: 'My Application',
description: 'Fast React development',
creator: '@yourhandle',
images: ['/og-image.png']
},
icons: {
icon: [
{ url: '/favicon.svg', type: 'image/svg+xml' },
{ url: '/favicon-16x16.png', type: 'image/png', sizes: '16x16' },
{ url: '/favicon-32x32.png', type: 'image/png', sizes: '32x32' }
],
apple: [{ url: '/apple-touch-icon.png', sizes: '180x180' }]
},
manifest: '/site.webmanifest'
};
export default function RootLayout({ children }) {
return (
<html lang="en">
<head>{/* Meta tags auto-injected */}</head>
<body>{children}</body>
</html>
);
}
All metadata is automatically injected into the HTML head with proper OpenGraph, Twitter Card, and favicon tags.
npm run dev
Features:
http://localhost:3000.env files are loadednpm run preview
Preview the production build locally before deployment:
.env files like Next.jsnpm run build
Creates optimized production bundle in .bini/dist/:
npm run start
# or
npm start
Launches Fastify production server with:
.bini/dist/ (validated before start)/api/*/health for monitoring/metrics for Prometheus/monitoringConfigure your application settings:
export default {
outDir: '.bini', // Build output directory
port: 3000, // Development server port
host: 'localhost', // HMR host
api: {
dir: 'src/app/api', // API routes directory
bodySizeLimit: '1mb' // Request body size limit
},
static: {
dir: 'public', // Static files directory
maxAge: 3600 // Cache max-age in seconds
},
build: {
minify: true, // Minify output
sourcemap: true // Include source maps
}
};
Create a .env.local file for environment-specific settings:
VITE_APP_NAME=My Application
VITE_APP_URL=http://localhost:3000
VITE_API_BASE=/api
# Production
SKIP_UPDATE_CHECK=true
CORS_ENABLED=true
RATE_LIMIT=1000
NODE_ENV=production
PORT=3000
HMR_HOST=0.0.0.0
| Feature | Details |
|---|---|
| Path Validation | All file paths validated, traversal attacks prevented |
| Input Sanitization | Deep object traversal, circular reference detection |
| Prototype Pollution | Dangerous properties blocked (__proto__, constructor) |
| Rate Limiting | 100 req/15min per IP (configurable) with headers |
| Helmet Headers | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer Policy |
| CORS Protection | Optional CORS with whitelist support |
| Graceful Shutdown | 30-second timeout for active requests (SIGTERM/SIGINT) |
| Race Condition Protection | Async locks prevent simultaneous operations |
| Memory Leak Prevention | TTL-based cache with automatic cleanup |
| Process Detection | Identifies blocking processes on Windows/macOS/Linux |
| Port Scanning | Intelligent port selection with <1 second detection |
| TypeScript Safety | Type-checked API routes prevent runtime errors |
# Bini.js automatically handles this – just run the command
npm run dev
# Use different port if needed
PORT=3001 npm start
# Solution: Run build first
npm run build
# Then start production server
npm start
# Check API route location: src/app/api/
# Verify file structure:
# ✅ src/app/api/hello.ts or hello.js
# ❌ src/api/hello.ts (wrong location)
# Default export required:
export default function handler(req, res) {
return { message: 'Hello' };
}
[id] and [...slug] patterns/health and /metrics for monitoringMIT – Free for personal and commercial use.
Bini.js v9.1.5 — Built with ❤️ using Vite, React, and Fastify
GitHub · Documentation · npm · Sponsor
FAQs
Bini.js v9.2.1: Enterprise-grade React framework with automatic source code protection, Next.js-style file-based routing, API routes with TypeScript support, Fastify production server (2x faster than Express), head-only SSR for SEO, hot module replacement
The npm package create-bini-app receives a total of 25 weekly downloads. As such, create-bini-app popularity was classified as not popular.
We found that create-bini-app demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.