
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
fetch-to-node
Advanced tools
A library providing Node.js-compatible request and response objects for WinterTC (fetch
-like) runtimes,
such as Cloudflare Workers, Bun, Deno and Fastly Compute.
Useful for when you're using a Node.js library in one of these environments that expects Node.js-style req
and res
objects,
for example Express.
This is basically the inverse of libraries like @mjackson/node-fetch-server
that allow the use of Request
/Response
signatures in Node.js servers.
This library is a copy/fork of Katsuyuki Omuro's great @fastly/http-compute-js project and wouldn't be possible without the hard work put in there. The changes here were largely made to remove dependencies and make the interfaces more generic.
That said, this library does depend on a certain level of Node.js compatibility (Readable
, Writable
from node:stream
and Buffer
from node:buffer
).
So please check out @fastly/http-compute-js if this library doesn't work for you.
import { toReqRes, toFetchResponse } from "fetch-to-node";
export default {
async fetch(request: Request): Promise<Response> {
// Create Node.js-compatible req and res from request
const { req, res } = toReqRes(request);
// Use req/res as you would in a Node.js application
res.writeHead(200, { "Content-Type": "application/json" });
res.end(
JSON.stringify({
data: "Hello World!",
})
);
// Create a Response object based on res, and return it
return await toFetchResponse(res);
},
};
NB: If you're using Cloudflare Workers, be sure to set the nodejs_compat
flag.
req
and res
are implementations of IncomingMessage
and
ServerResponse
, respectively, and
can be used as in a Node.js program.
toReqRes(request)
Request
object to a pair of Node.js-compatible request and response objects.request
- A Request
object. You would
typically obtain this from the request
received by your fetch
handler.req
- An http.IncomingMessage
object whose Readable
interface has been wired to the Request
object's body
. NOTE: This is an error
if the Request
's body
has already been used.res
- An http.ServerResponse
object whose Writable
interface has been wired to an in-memory buffer.toFetchResponse(res)
Response
object from the res
object above, based on the status code, headers, and body that has been
written to it.res
- An http.ServerResponse
object created by toReqRes()
.Response
object.Promise
that resolves to a Response
once the res
object emits the
'finish'
event, which typically happens when you call
res.end()
. If your application never signals the
end of output, this promise will never resolve, and your application will likely error or time out.1.1
.socket
property of these objects is always null
, and cannot be assigned.ServerResponse
write stream must be finished before the Response
object is generated.http.Agent
, http.ClientRequest
, http.get()
, http.request()
, to name a few.MIT.
In order for this library to function without requiring a direct dependency on Node.js itself, portions of the code in this library are adapted / copied from Node.js. Those portions are Copyright Joyent, Inc. and other Node contributors. See the LICENSE file for details.
[2.1.0] - 2025-04-26
FAQs
Node.js-compatible request and response objects for WinterTC runtimes
The npm package fetch-to-node receives a total of 13,559 weekly downloads. As such, fetch-to-node popularity was classified as popular.
We found that fetch-to-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.