
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Simple filesharing express-style middleware.
NOTE: this library is a wrapper around multer and serve-static. It's mean for novice users or those who want easy file server bootstrapping. If you're advanced user you're better off using and configuring multer and serve-static directly.
This is a version 2. It has some major breaking changes:
dest options parameter to destinationFor info on version 1 see v1 branch.
npm i fshare
Include it:
const fshare = require('fshare')
And then mount it:
app.use('/', fshare())
POST multipart/form-data file under parameter name file to wherever your fshar mountpoint is and after upload you will receive a file id which you can use to retrieve a file from server. A response with 200 code will contain a plain text file id that is used to later retrieve file from server. Any other response that isn't 200 code should be treated as error and will most likely contain an html/plaintext error message in a body.
To retrieve a file from server GET to fshare_mountpoint/id where id is your file id returned when file was uploaded. And the file will be sent to the browser.
One can pass options object to the fshare(options) middleware function.
Current options are:
destination: specifies a destination folder for uploads, by default files go into /tmp/fshare or similar tmp dir for your OS.limits: this are passed straight to multer "limits" options atribute. Read more about it on multer.NOTE: you may have to tweak limits fileSize to prevent spam attacks of uploading huge files to the server.
const express = require("express")
const fshare = require('fshare')
const app = express()
app.use('/upload', fshare({ destination: __dirname+'/uploads' }))
app.listen(1337, () => {
console.log("Listening on 1337")
})
You can use a curl to test uploading a file:
curl -F 'file=@/full/path/to/file' -v http://localhost:1337/upload
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.