find-my-way
Advanced tools
The find-my-way npm package is a fast HTTP router for Node.js. It is designed to help developers create routing systems for web applications and APIs. It supports dynamic and static routing, HTTP methods, middleware, hooks, and versioning.
Static Routing
Static routing allows you to define routes for specific paths. When a request matches the path, the associated handler is called.
const findMyWay = require('find-my-way')({ defaultRoute: (req, res) => { res.end('Not Found') } });
findMyWay.on('GET', '/example', (req, res, params) => { res.end('This is a static route example'); });Dynamic Routing
Dynamic routing supports path parameters, enabling you to capture values from the URL path and pass them to your handler function.
findMyWay.on('GET', '/example/:param', (req, res, params) => { res.end(`Parameter value: ${params.param}`); });HTTP Methods
The package supports various HTTP methods, allowing you to define different handlers for GET, POST, PUT, DELETE, etc.
findMyWay.on('POST', '/example', (req, res, params) => { res.end('This is a POST method example'); });Middleware Support
Middleware functions can be used to perform actions before the final handler is executed.
findMyWay.use('/example', (req, res, params, next) => { console.log('Middleware executed'); next(); });Versioned Routes
Versioning allows you to define different handlers for different versions of your API.
findMyWay.on('GET', '/example', { version: '1.0.0' }, (req, res, params) => { res.end('This is version 1.0.0'); });Express is a widely-used web application framework for Node.js. It provides a robust set of features for web and mobile applications, including routing, middleware, and template engines. Compared to find-my-way, Express offers a more comprehensive solution with additional features beyond routing.
Koa-router is a router middleware for Koa, another Node.js web framework. It offers similar functionalities to find-my-way, such as HTTP method support and dynamic routing, but is specifically designed to work within the Koa ecosystem.
Hapi is a rich framework for building applications and services, which includes powerful plugin capabilities. It provides a more extensive set of features than find-my-way, including input validation, caching, authentication, and more.
A crazy fast HTTP router, internally uses an highly performant Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent.
If you want to see a benchmark comparison with the most commonly used routers, see here.
Do you need a real-world example that uses this router? Check out Fastify or Restify.
npm i find-my-way --save
const http = require('http')
const router = require('find-my-way')()
router.on('GET', '/', (req, res, params) => {
res.end('{"message":"hello world"}')
})
const server = http.createServer((req, res) => {
router.lookup(req, res)
})
server.listen(3000, err => {
if (err) throw err
console.log('Server listening on: http://localhost:3000')
})
Instance a new router.
You can pass a default route with the option defaultRoute.
const router = require('find-my-way')({
defaultRoute: (req, res) => {
res.statusCode = 404
res.end()
}
})
In case of a badly formatted url (eg: /hello/%world), by default find-my-way will invoke the defaultRoute, unless you specify the onBadUrl option:
const router = require('find-my-way')({
onBadUrl: (path, req, res) => {
res.statusCode = 400
res.end(`Bad path: ${path}`)
}
})
Trailing slashes can be ignored by supplying the ignoreTrailingSlash option:
const router = require('find-my-way')({
ignoreTrailingSlash: true
})
function handler (req, res, params) {
res.end('foo')
}
// maps "/foo/" and "/foo" to `handler`
router.on('GET', '/foo/', handler)
Duplicate slashes can be ignored by supplying the ignoreDuplicateSlashes option:
const router = require('find-my-way')({
ignoreDuplicateSlashes: true
})
function handler (req, res, params) {
res.end('foo')
}
// maps "/foo", "//foo", "///foo", etc to `handler`
router.on('GET', '////foo', handler)
Note that when ignoreTrailingSlash and ignoreDuplicateSlashes are both set to true, duplicate slashes will first be removed and then trailing slashes will, meaning //a//b//c// will be converted to /a/b/c.
You can set a custom length for parameters in parametric (standard, regex and multi) routes by using maxParamLength option, the default value is 100 characters.
If the maximum length limit is reached, the default route will be invoked.
const router = require('find-my-way')({
maxParamLength: 500
})
If you are using a regex based route, find-my-way will throw an error if detects potentially catastrophic exponential-time regular expressions (internally uses safe-regex2).
If you want to disable this behavior, pass the option allowUnsafeRegex.
const router = require('find-my-way')({
allowUnsafeRegex: true
})
According to RFC3986, find-my-way is case sensitive by default.
You can disable this by setting the caseSensitive option to false:
in that case, all paths will be matched as lowercase, but the route parameters or wildcards will maintain their original letter casing. You can turn off case sensitivity with:
const router = require('find-my-way')({
caseSensitive: false
})
The default query string parser that find-my-way uses is fast-querystring module. You can change this default setting by passing the option querystringParser and use a custom one, such as qs.
const qs = require('qs')
const router = require('find-my-way')({
querystringParser: str => qs.parse(str)
})
router.on('GET', '/', (req, res, params, store, searchParams) => {
assert.equal(searchParams, { foo: 'bar', baz: 'faz' })
})
router.lookup({ method: 'GET', url: '/?foo=bar&baz=faz' }, null)
You can assign a buildPrettyMeta function to sanitize a route's store object to use with the prettyPrint functions. This function should accept a single object and return an object.
const privateKey = new Symbol('private key')
const store = { token: '12345', [privateKey]: 'private value' }
const router = require('find-my-way')({
buildPrettyMeta: route => {
const cleanMeta = Object.assign({}, route.store)
// remove private properties
Object.keys(cleanMeta).forEach(k => {
if (typeof k === 'symbol') delete cleanMeta[k]
})
return cleanMeta // this will show up in the pretty print output!
}
})
store[privateKey] = 'private value'
router.on('GET', '/hello_world', (req, res) => {}, store)
router.prettyPrint()
//└── / (-)
// └── hello_world (GET)
// • (token) "12345"
Register a new route.
router.on('GET', '/example', (req, res, params, store, searchParams) => {
// your code
})
Last argument, store is used to pass an object that you can access later inside the handler function. If needed, store can be updated.
router.on('GET', '/example', (req, res, params, store) => {
assert.equal(store, { message: 'hello world' })
}, { message: 'hello world' })
If needed, you can provide a version route constraint, which will allow you to declare multiple versions of the same route that are used selectively when requests ask for different version using the Accept-Version header. This is useful if you want to support several different behaviours for a given route and different clients select among them.
If you never configure a versioned route, the 'Accept-Version' header will be ignored. Remember to set a Vary header in your responses with the value you are using for defining the versioning (e.g.: 'Accept-Version'), to prevent cache poisoning attacks. You can also configure this as part your Proxy/CDN.
The default versioning strategy follows the semver specification. When using lookup, find-my-way will automatically detect the Accept-Version header and route the request accordingly. Internally find-my-way uses the semver-store to get the correct version of the route; advanced ranges and pre-releases currently are not supported.
Be aware that using this feature will cause a degradation of the overall performances of the router.
router.on('GET', '/example', { constraints: { version: '1.2.0' }}, (req, res, params) => {
res.end('Hello from 1.2.0!')
})
router.on('GET', '/example', { constraints: { version: '2.4.0' }}, (req, res, params) => {
res.end('Hello from 2.4.0!')
})
// The 'Accept-Version' header could be '1.2.0' as well as '*', '2.x' or '2.4.x'
If you declare multiple versions with the same major or minor find-my-way will always choose the highest compatible with the Accept-Version header value.
It's also possible to define a custom versioning strategy during the find-my-way initialization. In this case the logic of matching the request to the specific handler depends on the versioning strategy you use.
Register a new route for each method specified in the methods array.
It comes handy when you need to declare multiple routes with the same handler but different methods.
router.on(['GET', 'POST'], '/example', (req, res, params) => {
// your code
})
To register a parametric path, use the colon before the parameter name. For wildcard use the star. Remember that static routes are always inserted before parametric and wildcard.
// parametric
router.on('GET', '/example/:userId', (req, res, params) => {}))
router.on('GET', '/example/:userId/:secretToken', (req, res, params) => {}))
// wildcard
router.on('GET', '/example/*', (req, res, params) => {}))
Regular expression routes are supported as well, but pay attention, RegExp are very expensive in term of performance!
If you want to declare a regular expression route, you must put the regular expression inside round parenthesis after the parameter name.
// parametric with regexp
router.on('GET', '/example/:file(^\\d+).png', () => {}))
It's possible to define more than one parameter within the same couple of slash ("/"). Such as:
router.on('GET', '/example/near/:lat-:lng/radius/:r', (req, res, params) => {}))
Remember in this case to use the dash ("-") as parameters separator.
Finally it's possible to have multiple parameters with RegExp.
router.on('GET', '/example/at/:hour(^\\d{2})h:minute(^\\d{2})m', (req, res, params) => {}))
In this case as parameter separator it's possible to use whatever character is not matched by the regular expression.
The last parameter can be made optional if you add a question mark ("?") at the end of the parameters name.
router.on('GET', '/example/posts/:id?', (req, res, params) => {}))
In this case you can request /example/posts as well as /example/posts/1. The optional param will be undefined if not specified.
Having a route with multiple parameters may affect negatively the performance, so prefer single parameter approach whenever possible, especially on routes which are on the hot path of your application.
Note that you must encode the parameters containing reserved characters.
The routing algorithm matches one node at a time (where the node is a string between two slashes), this means that it cannot know if a route is static or dynamic until it finishes to match the URL.
The nodes are matched in the following order:
So if you declare the following routes
/foo/filename.png - static route/foo/:filename.png - route with param filename and static ending .png/foo/:filename.:ext - route with two params filename and ext/foo/:filename - route with one param filename/* - wildcard routeYou will have next matching rules:
/foo/filename.png.png extension. If one node static ending ends with another node static ending, the node with a longer static ending would have higher priority.
/foo/:filename.png.png - higher priority, more specific route/foo/:filename.png - lower priorityOnce a url has been matched, find-my-way will figure out which handler registered for that path matches the request if there are any constraints.
find-my-way will check the most constrained handlers first, which means the handlers with the most keys in the constraints object.
If you just want a path containing a colon without declaring a parameter, use a double colon. For example,
/name::customVerbwill be interpreted as/name:customVerb
The router is able to route all HTTP methods defined by http core module.
Used to deregister routes.
If no constraint argument is passed, all routes with identical path and method are deregistered, regardless of whether a route has constraints or not.
router.on('GET', '/example', { constraints: { host: 'fastify.io' } })
router.on('GET', '/example', { constraints: { version: '1.x' } })
router.on('GET', '/example')
// Deregisters all 3 routes registered above
router.off('GET', '/example')
If a constraint object is specified, only those routes are deleted that have the same constraints as well as the identical path and method. If an empty object is passed, only unconstrained routes will be deleted.
router.on('GET', '/example', { constraints: { host: 'fastify.io' } })
router.on('GET', '/example', { constraints: { version: '1.x' } })
router.on('GET', '/example')
// Deregisters only the third route without constraints
router.off('GET', '/example', {})
// Deregisters only the first route
router.off('GET', '/example', { host: 'fastify.io' })
Deregister a route for each method specified in the methods array. It comes handy when you need to deregister multiple routes with the same path but different methods. As explained above, the constraints will be ignored here.
router.on('GET', '/example', { constraints: { host: 'fastify.io' } })
router.on('POST', '/example', { constraints: { version: '1.x' } })
router.on('PUT', '/example')
// Deregisters all 3 routes registered above
router.off(['POST', 'GET', 'PUT'], '/example')
router.on('GET', '/example', { constraints: { host: 'fastify.io' } }) // first route
router.on('POST', '/example', { constraints: { host: 'fastify.io' } }) // second route
router.on('POST', '/example', { constraints: { host: 'google.de' } }) // third route
router.on('GET', '/example') // fourth route
router.on('POST', '/example') // fifth route
// Deregisters only first and second route
router.off(['POST', 'GET'], '/example', { host: 'fastify.io' })
// Deregisters only fourth and fifth route
router.off(['POST', 'GET'], '/example', {})
Finds a route by server route's path (not like find which finds a route by the url). Returns the route object if found, otherwise returns null. findRoute does not compare routes paths directly, instead it compares only paths patters. This means that findRoute will return a route even if the path passed to it does not match the route's path exactly. For example, if a route is registered with the path /example/:param1, findRoute will return the route if the path passed to it is /example/:param2.
const handler = (req, res, params) => {
res.end('Hello World!')
}
router.on('GET', '/:file(^\\S+).png', handler)
router.findRoute('GET', '/:file(^\\S+).png')
// => { handler: Function, store: Object }
router.findRoute('GET', '/:file(^\\D+).jpg')
// => null
const handler = (req, res, params) => {
res.end('Hello World!')
}
router.on('GET', '/:param1', handler)
router.findRoute('GET', '/:param1')
// => { handler: Function, store: Object }
router.findRoute('GET', '/:param2')
// => { handler: Function, store: Object }
Checks if a route exists by server route's path (see findRoute for more details). Returns true if found, otherwise returns false.
router.on('GET', '/:file(^\\S+).png', handler)
router.hasRoute('GET', '/:file(^\\S+).png')
// => true
router.hasRoute('GET', '/:file(^\\D+).jpg')
// => false
#### lookup(request, response, [context], [done])
Start a new search, `request` and `response` are the server req/res objects.<br>
If a route is found it will automatically call the handler, otherwise the default route will be called.<br>
The url is sanitized internally, all the parameters and wildcards are decoded automatically.
```js
router.lookup(req, res)
lookup accepts an optional context which will be the value of this when executing a handler
router.on('GET', '*', function(req, res) {
res.end(this.greeting);
})
router.lookup(req, res, { greeting: 'Hello, World!' })
lookup accepts an optional done callback for case when you use an async deriveConstraint function.
router.on('GET', '*', function(req, res) {
res.end({ hello: 'world' });
})
router.lookup(req, res, (err) => {
if (err !== null) {
// handle error
}
console.log('Handler executed!!!');
})
Return (if present) the route registered in method:path.
The path must be sanitized, all the parameters and wildcards are decoded automatically.
An object with routing constraints should usually be passed as constraints, containing keys like the host for the request, the version for the route to be matched, or other custom constraint values. If the router is using the default versioning strategy, the version value should be conform to the semver specification. If you want to use the existing constraint strategies to derive the constraint values from an incoming request, use lookup instead of find. If no value is passed for constraints, the router won't match any constrained routes. If using constrained routes, passing undefined for the constraints leads to undefined behavior and should be avoided.
router.find('GET', '/example', { host: 'fastify.io' })
// => { handler: Function, params: Object, store: Object}
// => null
router.find('GET', '/example', { host: 'fastify.io', version: '1.x' })
// => { handler: Function, params: Object, store: Object}
// => null
find-my-way builds a tree of routes for each HTTP method. If you call the prettyPrint
without specifying an HTTP method, it will merge all the trees to one and print it.
The merged tree does't represent the internal router structure. Don't use it for debugging.
findMyWay.on('GET', '/test', () => {})
findMyWay.on('GET', '/test/hello', () => {})
findMyWay.on('GET', '/testing', () => {})
findMyWay.on('GET', '/testing/:param', () => {})
findMyWay.on('PUT', '/update', () => {})
console.log(findMyWay.prettyPrint())
// └── /
// ├── test (GET)
// │ ├── /hello (GET)
// │ └── ing (GET)
// │ └── /
// │ └── :param (GET)
// └── update (PUT)
If you want to print the internal tree, you can specify the method param.
Printed tree will represent the internal router structure. Use it for debugging.
findMyWay.on('GET', '/test', () => {})
findMyWay.on('GET', '/test/hello', () => {})
findMyWay.on('GET', '/testing', () => {})
findMyWay.on('GET', '/testing/:param', () => {})
findMyWay.on('PUT', '/update', () => {})
console.log(findMyWay.prettyPrint({ method: 'GET' }))
// └── /
// └── test (GET)
// ├── /hello (GET)
// └── ing (GET)
// └── /
// └── :param (GET)
console.log(findMyWay.prettyPrint({ method: 'PUT' }))
// └── /
// └── update (PUT)
prettyPrint accepts an optional setting to print compressed routes. This is useful
when you have a large number of routes with common prefixes. Doesn't represent the
internal router structure. Don't use it for debugging.
console.log(findMyWay.prettyPrint({ commonPrefix: false }))
// ├── /test (GET)
// │ ├── /hello (GET)
// │ └── ing (GET)
// │ └── /:param (GET)
// └── /update (PUT)
To include a display of the store data passed to individual routes, the
option includeMeta may be passed. If set to true all items will be
displayed, this can also be set to an array specifying which keys (if
present) should be displayed. This information can be further sanitized
by specifying a buildPrettyMeta function which consumes and returns
an object.
findMyWay.on('GET', '/test', () => {}, { onRequest: () => {}, authIDs: [1, 2, 3] })
findMyWay.on('GET', '/test/hello', () => {}, { token: 'df123-4567' })
findMyWay.on('GET', '/testing', () => {})
findMyWay.on('GET', '/testing/:param', () => {})
findMyWay.on('PUT', '/update', () => {})
console.log(findMyWay.prettyPrint({ commonPrefix: false, includeMeta: ['onRequest'] }))
// ├── /test (GET)
// │ • (onRequest) "onRequest()"
// │ ├── /hello (GET)
// │ └── ing (GET)
// │ └── /:param (GET)
// └── /update (PUT)
console.log(findMyWay.prettyPrint({ commonPrefix: false, includeMeta: true }))
// ├── /test (GET)
// │ • (onRequest) "onRequest()"
// │ • (authIDs) [1,2,3]
// │ ├── /hello (GET)
// │ │ • (token) "df123-4567"
// │ └── ing (GET)
// │ └── /:param (GET)
// └── /update (PUT)
Empty router.
router.reset()
Return the all routes registered at moment, useful for debugging.
const findMyWay = require('find-my-way')()
findMyWay.on('GET', '/test', () => {})
findMyWay.on('GET', '/test/hello', () => {})
console.log(findMyWay.routes)
// Will print
// [
// {
// method: 'GET',
// path: '/test',
// opts: {},
// handler: [Function],
// store: undefined
// },
// {
// method: 'GET',
// path: '/test/hello',
// opts: {},
// handler: [Function],
// store: undefined
// }
// ]
const findMyWay = FindMyWay({
defaultRoute: (req, res) => {}
})
findMyWay.on('GET', '/user/:userId(^\\d+)', (req, res, params) => {})
findMyWay.on('GET', '/user/:username(^[a-z]+)', (req, res, params) => {})
// Method 'GET' already declared for route ':'
If you want an even nicer api, you can also use the shorthand methods to declare your routes.
For each HTTP supported method, there's the shorthand method. For example:
router.get(path, handler [, store])
router.delete(path, handler [, store])
router.head(path, handler [, store])
router.patch(path, handler [, store])
router.post(path, handler [, store])
router.put(path, handler [, store])
router.options(path, handler [, store])
// ...
If you need a route that supports all methods you can use the all api.
router.all(path, handler [, store])
find-my-way supports restricting handlers to only match certain requests for the same path. This can be used to support different versions of the same route that conform to a semver based versioning strategy, or restricting some routes to only be available on hosts. find-my-way has the semver based versioning strategy and a regex based hostname constraint strategy built in.
To constrain a route to only match sometimes, pass constraints to the route options when registering the route:
findMyWay.on('GET', '/', { constraints: { version: '1.0.2' } }, (req, res) => {
// will only run when the request's Accept-Version header asks for a version semver compatible with 1.0.2, like 1.x, or 1.0.x.
})
findMyWay.on('GET', '/', { constraints: { host: 'example.com' } }, (req, res) => {
// will only run when the request's Host header is `example.com`
})
Constraints can be combined, and route handlers will only match if all of the constraints for the handler match the request. find-my-way does a boolean AND with each route constraint, not an OR.
find-my-way will try to match the most constrained handlers first before handler with fewer or no constraints.
Custom constraining strategies can be added and are matched against incoming requests while trying to maintain find-my-way's high performance. To register a new type of constraint, you must add a new constraint strategy that knows how to match values to handlers, and that knows how to get the constraint value from a request. Register strategies when constructing a router or use the addConstraintStrategy method.
Add a custom constrain strategy when constructing a router:
const customResponseTypeStrategy = {
// strategy name for referencing in the route handler `constraints` options
name: 'accept',
// storage factory for storing routes in the find-my-way route tree
storage: function () {
let handlers = {}
return {
get: (type) => { return handlers[type] || null },
set: (type, store) => { handlers[type] = store }
}
},
// function to get the value of the constraint from each incoming request
deriveConstraint: (req, ctx) => {
return req.headers['accept']
},
// optional flag marking if handlers without constraints can match requests that have a value for this constraint
mustMatchWhenDerived: true
}
const router = FindMyWay({ constraints: { accept: customResponseTypeStrategy } });
Add a custom constraint strategy using the addConstraintStrategy method:
const asyncCustomResponseTypeStrategy = {
// strategy name for referencing in the route handler `constraints` options
name: 'accept',
// storage factory for storing routes in the find-my-way route tree
storage: function () {
let handlers = {}
return {
get: (type) => { return handlers[type] || null },
set: (type, store) => { handlers[type] = store }
}
},
// function to get the value of the constraint from each incoming request
deriveConstraint: (req, ctx, done) => {
done(null, req.headers['accept'])
},
// optional flag marking if handlers without constraints can match requests that have a value for this constraint
mustMatchWhenDerived: true
}
const router = FindMyWay({ constraints: { accept: asyncCustomResponseTypeStrategy } });
Add an async custom constrain strategy when constructing a router:
const customResponseTypeStrategy = {
// strategy name for referencing in the route handler `constraints` options
name: 'accept',
// storage factory for storing routes in the find-my-way route tree
storage: function () {
let handlers = {}
return {
get: (type) => { return handlers[type] || null },
set: (type, store) => { handlers[type] = store }
}
},
// function to get the value of the constraint from each incoming request
deriveConstraint: (req, ctx) => {
return req.headers['accept']
},
// optional flag marking if handlers without constraints can match requests that have a value for this constraint
mustMatchWhenDerived: true
}
const router = FindMyWay();
router.addConstraintStrategy(customResponseTypeStrategy);
Once a custom constraint strategy is registered, routes can be added that are constrained using it:
findMyWay.on('GET', '/', { constraints: { accept: 'application/fancy+json' } }, (req, res) => {
// will only run when the request's Accept header asks for 'application/fancy+json'
})
findMyWay.on('GET', '/', { constraints: { accept: 'application/fancy+xml' } }, (req, res) => {
// will only run when the request's Accept header asks for 'application/fancy+xml'
})
Constraint strategies should be careful to make the deriveConstraint function performant as it is run for every request matched by the router. See the lib/strategies directory for examples of the built in constraint strategies.
By default, find-my-way uses a built in strategies for the version constraint that uses semantic version based matching logic, which is detailed below. It is possible to define an alternative strategy:
const customVersioning = {
// replace the built in version strategy
name: 'version',
// provide a storage factory to store handlers in a simple way
storage: function () {
let versions = {}
return {
get: (version) => { return versions[version] || null },
set: (version, store) => { versions[version] = store }
}
},
deriveConstraint: (req, ctx) => {
return req.headers['accept']
},
mustMatchWhenDerived: true, // if the request is asking for a version, don't match un-version-constrained handlers
validate (value) { // optional validate function, validates the assigned value at route-configuration (the .on function) time (not the runtime-value)
assert(typeof value === 'string', 'Version should be a string')
}
}
const router = FindMyWay({ constraints: { version: customVersioning } });
The custom strategy object should contain next properties:
storage - a factory function to store lists of handlers for each possible constraint value. The storage object can use domain-specific storage mechanisms to store handlers in a way that makes sense for the constraint at hand. See lib/strategies for examples, like the version constraint strategy that matches using semantic versions, or the host strategy that allows both exact and regex host constraints.deriveConstraint - the function to determine the value of this constraint given a requestThe signature of the functions and objects must match the one from the example above.
Please, be aware, if you use your own constraining strategy - you use it on your own risk. This can lead both to the performance degradation and bugs which are not related to find-my-way itself!
It is inspired by the echo router, some parts have been extracted from trekjs router.
find-my-way - MIT
trekjs/router - MIT
Copyright © 2017-2019 Tomas Della Vedova
FAQs
Crazy fast http radix based router
We found that find-my-way demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.
Security News
The npm package for the LottieFiles Player web component was hit with a supply chain attack after a software engineer's npmjs credentials were compromised.