Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
formstream
Advanced tools
The formstream npm package is used to create multipart/form-data streams, which are useful for uploading files and data via HTTP requests. It simplifies the process of constructing form data streams, making it easier to handle file uploads in Node.js applications.
Create a form stream
This feature allows you to create a form stream, add fields and files to it, and then generate the stream for use in an HTTP request.
const formstream = require('formstream');
const form = formstream();
form.field('name', 'value');
form.file('file', '/path/to/file');
form.stream();
Add fields to the form
This feature allows you to add text fields to the form stream. Each field is added with a key-value pair.
const form = formstream();
form.field('username', 'john_doe');
form.field('email', 'john@example.com');
Add files to the form
This feature allows you to add files to the form stream. Each file is added with a key and the file path.
const form = formstream();
form.file('profile_picture', '/path/to/profile.jpg');
Generate the form stream
This feature generates the form stream after adding all the fields and files. The generated stream can then be used in an HTTP request.
const form = formstream();
form.field('username', 'john_doe');
form.file('profile_picture', '/path/to/profile.jpg');
const stream = form.stream();
The form-data package is a module to create readable 'multipart/form-data' streams. It is similar to formstream in that it allows you to construct form data streams for file uploads. However, form-data is more widely used and has more extensive documentation and community support.
The multiparty package is a module for parsing multipart/form-data, which is commonly used for file uploads. Unlike formstream, which focuses on creating form data streams, multiparty is used for parsing incoming form data streams. It is useful for handling file uploads on the server side.
The busboy package is a fast and low-level module for parsing incoming HTML form data. It is similar to multiparty in that it is used for parsing form data streams, but it is known for its performance and efficiency. It is a good choice for handling large file uploads.
A multipart/form-data encoded stream, helper for file upload.
npm install formstream
var formstream = require('formstream');
var http = require('http');
var form = formstream();
// form.file('file', filepath, filename);
form.file('file', './logo.png', 'upload-logo.png');
// other form fields
form.field('foo', 'fengmk2').field('love', 'aerdeng');
// even send file content buffer directly
// form.buffer(name, buffer, filename, mimeType)
form.buffer('file2', new Buffer('This is file2 content.'), 'foo.txt');
var options = {
method: 'POST',
host: 'upload.cnodejs.net',
path: '/store',
headers: form.headers()
};
var req = http.request(options, function (res) {
console.log('Status: %s', res.statusCode);
res.on('data', function (data) {
console.log(data.toString());
});
});
form.pipe(req);
var fs = require('fs');
var formstream = require('formstream');
var filepath = './logo.png';
fs.stat(filepath, function (err, stat) {
formstream()
.field('status', 'share picture')
.field('access_token', 'your access token')
.file('pic', filepath, 'logo.png', stat.size)
.pipe(process.stdout); // your request stream
});
Some web servers have a limit on the number of chunks, and you can set minChunkSize
to ensure the size of chunk sent to the server.
var fs = require('fs');
var FormStream = require('formstream');
var filepath = './big-file.zip';
fs.stat(filepath, function (err, stat) {
new FormStream({
// send >= 2MB chunk buffer size to the server
minChunkSize: 1024 * 1024 * 2,
}).field('status', 'share file')
.field('access_token', 'your access token')
.file('file', filepath, 'big-file.zip', stat.size)
.pipe(process.stdout); // your request stream
});
Create a form instance.
Form - form instance
Add a normal field to the form.
Form - form instance
Add a local file to be uploaded to the form.
filepath
if empty)Content-Length
header if not specified)Form - form instance
Add a buffer as a file to upload.
filename
if empty)Form - form instance
Add a readable stream as a file to upload. Event 'error' will be emitted if an error occured.
filename
if empty)Content-Length
header if not specified)Form - form instance
Get headers for the request.
var headers = form.headers({
'Authorization': 'Bearer kei2akc92jmznvnkeh09sknzdk',
'Accept': 'application/vnd.github.v3.full+json'
});
Object - Headers to be sent.
Emitted if there was an error receiving data.
The 'data' event emits when a Buffer was used.
See Node.js Documentation for more.
Emitted when the stream has received no more 'data' events will happen.
See Node.js Documentation for more.
fengmk2 | xingrz | semantic-release-bot | fjc0k | mrspeiser | dead-horse |
---|---|---|---|---|---|
shaozj |
This project follows the git-contributor spec, auto updated at Wed May 15 2024 00:34:12 GMT+0800
.
FAQs
A multipart/form-data encoded stream, helper for file upload.
We found that formstream demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.