
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
did-route is an isomorphic router that returns false when it didn’t handle a request.
$ npm install did-route
var http = require('http')
var did = require('did-route')()
// Home
did.get('/', function (req, res) {
res.end('Welcome to the homepage\n')
})
// Item
did.patch('/item/:id([a-f0-9]{16})',
function (req, res, params) {
res.end('Updated ' + params.id + '\n')
}
)
http.createServer(function (req, res) {
// No route has not been registered for
// this URI and HTTP method.
if (!did.route(req, res)) {
// A route *has* been registered for this
// URI, but not for this HTTP method.
if (did.match(req)) {
res.statusCode = 405
res.end()
return
}
res.statusCode = 404
res.end()
}
}).listen(8080)
Which would result in the following responses:
$ curl http://localhost:8080
> Welcome to the homepage
$ curl -X PATCH http://localhost:8080/item/6d80eb0c50b49a5
> Updated 6d80eb0c50b49a5
$ curl -iX DELETE http://localhost:8080/item/6d80eb0c50b49a5
> HTTP/1.1 405 Method Not Allowed
did-route also works in the browser with basically the same API. The only differences are that a) did.get is the only available routing method, and b) route handlers receive just one argument: the params object.
var did = require('did-route')()
did.get('/', function () {
// No request or response in the browser.
})
did.get('/:name([a-zA-Z]+)', function (params) {
// The only argument is the params object.
})
did.get('*#/:name([a-zA-Z]+)', function (params) {
// It's possible to define routes based on
// the value of location.hash.
})
window.onpopstate = function () {
var path = window.location || '/path/to/page'
if (!did.route(path)) {
// Handle 404
}
}
window.onhashchange = function () {
var includeQueryAndHash = true
if (!did.route(window.location, includeQueryAndHash)) {
// Handle 404
}
}
require('did-route')
| compression | size |
|---|---|
| did-route.js | 2.85 kB |
| did-route.min.js | 1.65 kB |
| did-route.min.js.gz | 850 B |
$ git clone git@github.com:michaelrhodes/did-route
$ cd did-route
$ npm install
$ npm run test:server
$ npm run test:browser
FAQs
an isomorphic router that returns false when it didn’t handle a request
The npm package did-route receives a total of 2 weekly downloads. As such, did-route popularity was classified as not popular.
We found that did-route demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.