
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Very Important: THIS IS A PREVIOUS VERSION OF FEATHERS. The
featherspackage and latest version has been moved to @feathersjs/feathers. See docs.feathersjs.com/migrating.html for more information.
Feathers is a real-time, micro-service web framework for NodeJS that gives you control over your data via RESTful resources, sockets and flexible plug-ins.
You can build your first real-time and REST API in just 4 commands:
$ npm install -g feathers-cli
$ mkdir my-new-app
$ cd my-new-app/
$ feathers generate app
$ npm start
To learn more about Feathers visit the website at feathersjs.com or jump right into the Feathers docs.
Here is all the code you need to create a RESTful, real-time message API that uses an in-memory data store:
// app.js
const feathers = require('feathers');
const rest = require('feathers-rest');
const socketio = require('feathers-socketio');
const memory = require('feathers-memory');
const bodyParser = require('body-parser');
const handler = require('feathers-errors/handler');
// A Feathers app is the same as an Express app
const app = feathers();
// Add REST API support
app.configure(rest());
// Configure Socket.io real-time APIs
app.configure(socketio());
// Parse HTTP JSON bodies
app.use(bodyParser.json());
// Parse URL-encoded params
app.use(bodyParser.urlencoded({ extended: true }));
// Register our memory "messages" service
app.use('/messages', memory());
// Register a nicer error handler than the default Express one
app.use(handler());
// Start the server
app.listen(3000);
Then run
npm install feathers feathers-rest feathers-socketio feathers-errors feathers-memory body-parser
node app
and go to http://localhost:3000/messages. That's it! There's a lot more you can do with Feathers including; using a real database, authentication, authorization, clustering and more! Head on over to the Feathers docs to see just how easy it is to build scalable real-time apps.
The Feathers docs are loaded with awesome stuff and tell you every thing you need to know about using and configuring Feathers.
Each plugin has it's own minimal example in the repo. To see a more complex example go to feathersjs/feathers-chat.
We :heart: the community and take security very seriously. No one wants their app hacked. If you have come across a security concern please report it responsibly. Visit the Security section of the docs to learn more about how you can make sure your app is secure.
We are going to be following along with the Node.js long term support cycle. As a result we have dropped official support for node v0.10, v0.12, and iojs versions. Feathers still works on those versions but we're not going to ensure it will going forward.
We will be supporting Node.js v4 until 2018-04-01. We will be supporting Node.js v6 until 2019-04-18.
FAQs
Build Better APIs, Faster than Ever.
The npm package feathers receives a total of 1,105 weekly downloads. As such, feathers popularity was classified as popular.
We found that feathers demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.