
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
Download Source:
Install with npm
npm install grapnel
Or by using bower:
bower install grapnel
Server only: (with HTTP methods added, more info)
npm install grapnel-server
pushState or hashchange concurrently# or #! for hashchange routingvar router = new Grapnel();
router.get('products/:category/:id?', function(req){
var id = req.params.id,
category = req.params.category;
// GET http://mysite.com/#products/widgets/134
console.log(category, id);
// => widgets 134
});
var router = new Grapnel({ pushState : true });
router.get('/products/:category/:id?', function(req){
var id = req.params.id,
category = req.params.category
console.log(category, id);
});
router.navigate('/products/widgets/134');
// => widgets 134
Grapnel supports regex style routes similar to Sinatra, Restify, and Express. The properties are mapped to the parameters in the request.
router.get('products/:id?', function(req){
// GET /file.html#products/134
req.params.id
// => 134
});
router.get('products/*', function(req){
// The wildcard/asterisk will match anything after that point in the URL
// Parameters are provided req.params using req.params[n], where n is the nth capture
});
Grapnel also supports middleware:
var auth = function(req, event, next){
user.auth(function(err){
req.user = this;
next();
});
}
router.get('/*', auth, function(req){
console.log(req.user);
});
You can add context to a route and even use it with middleware:
var usersRoute = router.context('/user/:id', getUser, getFollowers); // Middleware can be used here
usersRoute('/', function(req, event){
console.log('Profile', req.params.id);
});
usersRoute('/followers', otherMiddleware, function(req, event){ // Middleware can be used here too
console.log('Followers', req.params.id);
});
router.navigate('/user/13589');
// => Profile 13589
router.navigate('/user/13589/followers');
// => Followers 13589
This is now simplified as a separate package (more info)
npm install grapnel-server
var http = require('http'),
app = require('grapnel-server');
app.get('/', function(req, res, next){
res.end('Hello World!', 200);
});
http.createServer(app.start()).listen(3000);
var routes = {
'products' : function(req){
// GET /file.html#products
},
'products/:category/:id?' : function(req){
// GET /file.html#products/widgets/35
req.params.category
// => widgets
}
}
Grapnel.listen(routes);
var router = new Grapnel({ pushState : true, root : '/' });
router.on('navigate', function(event){
// GET /foo/bar
console.log('URL changed to %s', this.path());
// => URL changed to /foo/bar
});
Grapnel allows RegEx when defining a route:
var expression = /^food\/tacos\/(.*)$/i;
var router = new Grapnel();
router.get(expression, function(req, event){
// GET http://mysite.com/page#food/tacos/good
console.log('I think tacos are %s.', req.params[0]);
// => "He thinks tacos are good."
});
require(['lib/grapnel'], function(Grapnel){
var router = new Grapnel({ pushState : true });
router.bind('navigate', function(){
console.log('It works!');
});
router.navigate('/');
});
var router = new Grapnel();
Or you can declare your routes with a literal object:
Grapnel.listen({
'products/:id' : function(req){
// Handler
}
});
When declaring routes with a literal object, router options can be passed as the first parameter:
var opts = { pushState : true };
Grapnel.listen(opts, routes);
var router = new Grapnel({ pushState : true });
You can also specify a root URL by setting it as an option:
var router = new Grapnel({ root : '/public/search/', pushState : true });
The root may require a beginning slash and a trailing slash depending on how your application utilizes the router.
Grapnel uses middleware similar to how Express uses middleware. Middleware has access to the req object, event object, and the next middleware in the call stack (commonly denoted as next). Middleware must call next() to pass control to the next middleware, otherwise the router will stop.
For more information about how middleware works, see Using Middleware.
var user = function(req, event, next){
user.get(function(err){
req.user = this;
next();
});
}
router.get('/user/*', user, function(req){
console.log(req.user);
});
If pushState is enabled, you can navigate through your application with router.navigate:
router.navigate('/products/123');
router.on('match', function(event){
event.preventDefault(); // Stops event handler
});
router.get('/products/:id', function(req, event){
event.stopPropagation(); // Stops propagation of the event
});
router.get('/products/widgets', function(req, event){
// This will not be executed
});
router.navigate('/products/widgets');
You can specify a route that only uses a wildcard * as your final route, then use event.parent() which returns false if the call stack doesn't have any other routes to run.
var routes = {
'/' : function(req, e){
// Handle route
},
'/store/products/:id' : function(req, e){
// Handle route
},
'/category/:id' : function(req, e){
// Handle route
},
'/*' : function(req, e){
if(!e.parent()){
// Handle 404
}
}
}
Grapnel.listen({ pushState : true }, routes);
get Adds a listeners and middleware for routes/**
* @param {String|RegExp} path
* @param {Function} [[middleware], callback]
*/
router.get('/store/:category/:id?', function(req, event){
var category = req.params.category,
id = req.params.id;
console.log('Product #%s in %s', id, category);
});
navigate Navigate through application/**
* @param {String} path relative to root
*/
router.navigate('/products/123');
on Adds a new event listener/**
* @param {String} event name (multiple events can be called when separated by a space " ")
* @param {Function} callback
*/
router.on('myevent', function(event){
console.log('Grapnel works!');
});
once A version of on except its handler will only be called once/**
* @param {String} event name (multiple events can be called when separated by a space " ")
* @param {Function} callback
*/
router.once('init', function(){
console.log('This will only be executed once');
});
trigger Triggers an event/**
* @param {String} event name
* @param {Mixed} [attributes] Parameters that will be applied to event handler
*/
router.trigger('event', eventArg1, eventArg2, etc);
context Returns a function that can be called with a specific route in context.Both the router.context method and the function it returns can accept middleware. Note: when calling route.context, you should omit the trailing slash.
/**
* @param {String} Route context (without trailing slash)
* @param {[Function]} Middleware (optional)
* @return {Function} Adds route to context
*/
var usersRoute = router.context('/user/:id');
usersRoute('/followers', function(req, event){
console.log('Followers', req.params.id);
});
router.navigate('/user/13589/followers');
// => Followers 13589
pathrouter.path('string') Sets a new path or hashrouter.path() Gets path or hashrouter.path(false) Clears the path or hashbind An alias of onadd An alias of getfragment (Deprecated)pushState Enable pushState, allowing manipulation of browser history instead of using the # and hashchange eventroot Root of your app, all navigation will be relative to thishashBang Enable #! as the anchor of a hashchange router instead of using just a #navigate Fires when router navigates through historymatch Fires when a new match is found, but before the handler is calledhashchange Fires when hashtag is changedFAQs
The first (and smallest!) JavaScript Router with PushState, Middleware, and Named Parameter support
The npm package grapnel receives a total of 457 weekly downloads. As such, grapnel popularity was classified as not popular.
We found that grapnel demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.