
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
fastify-live-refresh
Advanced tools
This package is a quick and easy way to refresh the browser from the server so you can see live updates whenever you save your files.
This package is a quick and easy way to refresh the browser from the server so you can see live updates whenever you save your files.
Auto-injecting WebSocket client for Fastify that enables live reloading of the browser.
import fastifyWebsocket from '@fastify/websocket';
import { FastifyLiveRefresh } from 'fastify-live-refresh'
app.register(fastifyWebsocket);
const liveRefresh = new FastifyLiveRefresh(app);
You must trigger the live refresh yourself, this lets the package be unopinionated. You choose when to run the refresh() method and the client will be updated. I tend to just run a file watcher with chokidar.
if(isDev)
{
app.register(fastifyWebsocket);
const liveRefresh = new FastifyLiveRefresh(app);
chokidar.watch(publicDir, { ignoreInitial: true }).on("all", (event, filePath) => {
liveRefresh.refresh()
});
}
This will set up a WebSocket for you with zero configuration and it will automatically inject and serve the needed client-side JS so it just works like magic.
Zero Configuration: Just create an instance and pass it your Fastify app.
Self-Contained: No need for extra setup—just install and use.
npm install fastify-live-refresh
Auto-injects the WebSocket client into HTML pages
Serves the client-side script automatically
Works out-of-the-box with Fastify
No dependencies beyond Fastify itself
Minimalist API, no complex configuration needed
By default, the WebSocket server runs at:
Route: /ws-HOT-CLIENT-FASTIFY-RESERVED-ROUTE
Script URL: /AUTO-INJECTED-BY-HOT-CLIENT-FASTIFY.js
You can override the route in the constructors options
new HotClientFastify(fastify, { route: '/my-custom-ws-route' });
This package is intended to save a few hours of research and experimentation to rebuild this functionality in each web app I make. Its scope is small enough that it is currently complete outside of being battle-tested and will most likely not receive any further updates unless major infrastructure changes occur to Fastify.
FAQs
This package is a quick and easy way to refresh the browser from the server so you can see live updates whenever you save your files.
We found that fastify-live-refresh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.