
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
featurefuse-sdk
Advanced tools
npm install featurefuse-sdk
# or yarn add featurefuse-sdk
fetchSpecificFlags(environmentID, flagNames, url?)Fetch only specific flags by name using the flag query parameter.
import { fetchSpecificFlags } from "featurefuse-sdk";
// Fetch a single flag
const chatFlag = await fetchSpecificFlags("ENV_ID", "chat_widget");
// Fetch multiple flags
const selectedFlags = await fetchSpecificFlags("ENV_ID", [
"chat_widget",
"beta_feature"
]);
init(options)Fetches flags once by appending ?envID=... to the URL, so no custom headers are sent.
options.environmentID (string) requiredoptions.url (string) override default endpointoptions.flagNames (string[]|string) fetch only specific flag(s) (uses the flag query parameter)import { init, hasFeature, getFlags } from "featurefuse-sdk";
// Default SaaS endpoint:
const flags = await init({ environmentID: "ENV_ID" });
// Fetch only specific flags:
const selectedFlags = await init({
environmentID: "ENV_ID",
flagNames: ["chat_widget", "beta_feature"]
});
hasFeature(name)Check if a specific feature is enabled.
getFlags()Retrieve last-fetched flags object.
fetchFlagsPost(environmentID, url?)Fetch flags using POST method to completely bypass browser cache. This is useful when GET requests are being cached aggressively.
import { fetchFlagsPost } from "featurefuse-sdk";
// Fetch using POST to bypass cache
const flags = await fetchFlagsPost("ENV_ID");
Supported React versions: 16.8+ (hooks), 17, 18, and 19
The React bindings use useSyncExternalStore for stable subscriptions across all React versions, with automatic fallback to use-sync-external-store/shim for React 16.8 and 17.
import {
FeatureFuseProvider,
useFlags,
useFlag,
useForceRefresh
} from "featurefuse-sdk/react";
function App() {
return (
<FeatureFuseProvider
options={{
environmentID: "ENV_ID",
// pollInterval: 10000, // Optional: polling disabled by default
// onError: (error) => console.error('Flag fetch failed:', error)
}}
>
<HomePage />
</FeatureFuseProvider>
);
}
function HomePage() {
// Get multiple flags
const flags = useFlags(["chat_widget", "beta_feature"]);
// Or get a single flag
const chatFlag = useFlag("chat_widget");
const forceRefresh = useForceRefresh();
return (
<>
{chatFlag.enabled && <ChatWidget />}
{flags.beta_feature?.enabled && <BetaFeature />}
<button onClick={forceRefresh}>Refresh Flags</button>
</>
);
}
environmentID (string) required - Your FeatureFuse environment IDurl (string) - Override the default API endpointflagNames (string[]) - Filter to only fetch specific flagspollInterval (number) - How often to poll for flag updates in ms (default: 0 = disabled)onError (function) - Error handler for fetch failures (error) => voiduseFlags(keys?) - Get feature flags. Pass an array of flag names or leave empty for all flagsuseFlag(name) - Get a single feature flag by name. Returns { enabled: boolean, value?: unknown }useForceRefresh() - Get a function to manually refresh flags and trigger re-rendersNote: The SDK automatically triggers component re-renders when feature flags change, ensuring your UI stays in sync with flag updates.
useSyncExternalStore with proper change detectionpollInterval optionuse-sync-external-store/shimuse-sync-external-store/shimuseSyncExternalStoreThe SDK uses only public React APIs and properly externals React packages to avoid version conflicts.
The SDK implements multiple cache-busting strategies to ensure you always get the latest feature flag values:
Cache-Control, Pragma, Expires, If-None-Match, and If-Modified-SinceRequest constructor with cache: "no-cache" to bypass browser cachefetchFlagsPost() function that uses POST requests to completely bypass GET cachingIf you're still experiencing caching issues, you can:
fetchFlagsPost() function to bypass GET caching completelyuseForceRefresh() hook in React components (automatically tries POST first)pollInterval in the React provider for more frequent updatespip install featurefuse-sdkInstall-Package FeatureFuse.SDKnpm publish --access public
# or
yarn publish --access public
MIT
FAQs
Minimal JavaScript SDK for FeatureFuse feature flags
We found that featurefuse-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.