
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
hono-json-response
Advanced tools
A Hono middleware for standardized JSON responses
return c.json({ code: 2000, data: users, msg: 'Operation successful' });
return c.json({ code: 2000, data: roles, msg: 'Operation successful' });
return c.json({ code: 5000, data: null, msg: 'Username already exists' });
return c.json({ code: 5100, data: null, msg: 'System error' });
return c.ok(users, 'Operation successful');
return c.ok(roles); // No need to pass "Operation successful" every time, as it's the default
return c.bizerr(null, 'Username already exists');
return c.syserr();
c.ok() is more intuitive than c.json({code: 2000})c.json({code: xxx, data: xxx, msg: xxx}) patterns# npm
npm install hono-json-response
# yarn
yarn add hono-json-response
# pnpm
pnpm add hono-json-response
# bun
bun add hono-json-response
import { Hono } from 'hono';
import { jsonResponse } from 'hono-json-response';
const app = new Hono();
app.use('*', jsonResponse());
app.get('/getUserList', c => {
return c.ok(
{
list: [{ name: 'John' }, { name: 'Jane' }],
totals: 100
},
'Get user list successfully'
);
});
All responses follow a unified JSON format (code, data, msg):
{
"code": 2000,
"data": null,
"msg": ""
}
Support custom response field names to adapt to different project API specifications:
app.use(
'*',
jsonResponse(null, {
code: 'status', // code -> status
data: 'result', // data -> result
msg: 'message' // msg -> message
})
);
c.ok(data?, msg?)Success response
app.get('/getUserList', c => {
return c.ok(
{
list: [{ name: 'John' }, { name: 'Jane' }],
totals: 100
},
'Get user list successfully'
);
});
c.unauth(data?, msg?)Unauthorized response
app.post('/login', c => {
return c.unauth();
});
c.bizerr(data?, msg?)Business error response
app.post('/register', async c => {
const { name } = await c.req.json();
return c.bizerr({ name }, `Username ${name} already exists`);
});
c.syserr(data?, msg?)System error response
app.post('/foo', c => {
try {
// do something
} catch (error) {
return c.syserr(error);
}
});
c.jr(code, data?, msg?)Custom response code
app.get('/orders/:id', async c => {
const orderId = c.req.param('id');
try {
const order = await getOrderById(orderId);
// Order not found
if (!order) {
return c.jr(5000, null, 'Order not found');
}
// No permission to access other user's order
if (order.userId !== userId) {
return c.jr(5001, null, 'No permission to access this order');
}
// Order has been deleted
if (order.status === 'deleted') {
return c.jr(5002, null, 'Order has been deleted');
}
// More business logic...
return c.ok(order, 'Get order details successfully');
} catch (error) {
return c.syserr(null, 'Failed to get order details');
}
});
app.use(
'*',
jsonResponse({
ok: { code: 20000, defaultMsg: 'Override ok' },
unauth: { code: 40000, defaultMsg: 'Override unauth' }
})
);
import type { JSONResponseHandler } from 'hono-json-response';
// Don't forget to use TypeScript module augmentation to extend Context type
declare module 'hono' {
interface Context {
warning: JSONResponseHandler;
forbidden: JSONResponseHandler;
}
}
app.use(
'*',
jsonResponse({
warning: { code: 2001, defaultMsg: 'Warning message' },
forbidden: { code: 4001, defaultMsg: 'Access forbidden' }
})
);
app.get('/warning', c => {
return c.warning(data, 'API will be deprecated');
});
When custom method status codes conflict with default methods, default methods will be automatically removed:
app.use(
'*',
jsonResponse({
mySuccess: { code: 2000 } // Conflicts with default ok method
})
);
// At this point, c.ok method is no longer available, only c.mySuccess is available
Copyright (c) 2025-present, Zhifeng (Jeff) Wang
FAQs
A Hono middleware for standardized JSON responses
The npm package hono-json-response receives a total of 261 weekly downloads. As such, hono-json-response popularity was classified as not popular.
We found that hono-json-response demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.