
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
express-msgpack
Advanced tools
Express and MessagePack, together at last. Uses @msgpack/msgpack by default.
Provides transparent middleware that can be used to support clients requesting
Accept: application/msgpack from endpoints using res.json or sending
Content-Type: application/msgpack to any endpoint. You can continue to use
req.body and res.json and expressMsgpack will handle the conversion in
the background using @msgpack/msgpack (or any compatible library of your
choice).
$ npm install --save express-msgpack
// or
$ yarn add express-msgpack
If you intend to use an alternative to @msgpack/msgpack (see Configuration)
you can add the --no-optional flag; it's an optional dependency.
import msgpack from "express-msgpack";
// ...
app.use(msgpack());
const msgpack = require("express-msgpack").default;
// ...
app.use(msgpack());
To configure, pass options when you configure the middleware. Currently supported options are:
| Parameter | Description | Default |
|---|---|---|
allowUnacceptableResponse | a boolean indicating whether the response should still be sent if the client doesn't set a compatible Accept type (rather than a 406 Not Acceptable response) | false |
decoder | a function converting from MessagePack to JavaScript | @msgpack/msgpack#decode |
encoder | a function converting from JavaScript to MessagePack | @msgpack/msgpack#encode (with a wrapper to convert the result to a Buffer) |
mimeType | the MIME type to detect and set for MessagePack payloads | "application/msgpack" |
limit | The byte limit of the body. This is the number of bytes or any string format supported by bytes | "100kb" |
For example, to switch to the node-gyp C++ based msgpack library:
import msgpack from "express-msgpack";
import { pack, unpack } from "msgpack";
// ...
app.use(msgpack({ decoder: unpack, encoder: pack }));
The project has code linting and testing, using the following commands:
npm run e2e: run the smoke/E2E testsnpm run lint: run the ESLint checksnpm run ship: lint and run unit, integration and E2E testsnpm test: run the Jest unit and integration testsnpm test:watch: run the tests in watch modeThe tests are in the __tests__/ directory and are run using Jest. They're
split into two files:
unit.test.ts - mockist unit tests, to check specific internal detailsintegration.test.ts - integration tests using SuperTest with a simple
Express app using the middlewareThere is also a smoke.test.js file containing E2E/smoke tests for a deployed
version of the package, used by bin/smoke.js. If the --local argument is
supplied to the script the local version is packaged and tested , otherwise
the specified -tag version is installed from the registry and tested.
FAQs
Transparent MessagePack middleware for Express
We found that express-msgpack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.