
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
digest-fetch
Advanced tools
digest auth request plugin for fetch/node-fetch.
// dependencies for node
npm install crypto-js node-fetch
// dependencies for browser
<script src='path-to-crypto-js.js'></script>
npm install digest-fetch
const DigestFetch = require('digest-fetch')
const client = DigestFetch('user', 'password', console) // console as logger, optional parameter
// do request same way as fetch or node-fetch
const url = ''
const options = {}
client.fetch(url, options)
.then(resp=>resp.json())
.then(data=>console.log(data))
.catch(e=>console.error(e))
Axios is a popular HTTP client for Node.js and the browser. While it does not natively support digest authentication, it can be extended with custom interceptors to handle digest authentication. Axios is more versatile and widely used compared to digest-fetch.
Node-fetch is a lightweight module that brings window.fetch to Node.js. Similar to axios, it does not natively support digest authentication but can be extended with custom logic. Node-fetch is simpler and more lightweight compared to digest-fetch.
Request is a comprehensive HTTP client for Node.js that supports various authentication methods, including digest authentication. However, it is now deprecated and not recommended for new projects. Request is more feature-rich but less maintained compared to digest-fetch.
FAQs
digest auth request plugin for fetch/node-fetch also support http basic auth authentication
The npm package digest-fetch receives a total of 408,191 weekly downloads. As such, digest-fetch popularity was classified as popular.
We found that digest-fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.