
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
hot-controller
Advanced tools
hot-controller is a zero-config, hot-reloading controller library for node.js.
async/await supportexpress or standalone.npm install -g hot-controller
or
yarn global add hot-controller
npm install hot-controller --save or yarn add hot-controllerpackage.json add the following:
"scripts": {
...
"start": "hot-controller serve",
"dev": "hot-controller"
}
express applicationnpm install hot-controller --save or yarn add hot-controller
Add the middleware to existing express:
const hotControllers = require('hot-controller/middleware');
...
app.use(hotControllers(/* (optional) options */));
Create a directory in the root of your project called controllers
All files in this directory will be parsed as a controller with hot-controller.
/controllers/home.js
import { Controller, Route } from 'hot-controller';
// which path it should reside on
@Controller('/api')
export default class HomeController {
// declare your methods below
@Route.GET('/') // matches /api
index(req, res) {
//
res.send('Welcome');
}
@Route.GET('/about')
users(req, res) {
// redirect user to somewhere else
res.redirect('/somewhere-else');
}
@Route.GET('/users/:id') // matches /api/users/:id
async user(req, res) {
// this is a async method
const user = await getUserById(req.params.id); // get the user data
// send it as json
res.json({
user
});
}
}
Get more examples in our examples repo
hot-controller fully supports plugins and is easily activatable in your config.
We follow the "babel plugin naming scheme". (hot-controller-plugin-[PLUGIN_NAME]) and later in your .controllersrc (or what configuration method you're using) add "plugins": [ "plugin-name" ]
To write your controllers in typescript please checkout our very own plugin [hot-controller-plugin-typescript)(https://github.com/hot-controller/hot-controller-plugin-typescript)
Writing a plugin for hot-controller is very simple. All it takes is a function.
module.exports = function(events) {
events.on('after-plugins-init', plugins => {
// will be fired immediately after all plugins been constructed
});
events.on('before-controller', router => {
// before any controllers will be loaded
// using "router" argument you can add plugin specific routes or add an express middleware.
});
events.on('after-controller', (router, controllers) => {
// after all controllers has been added to the router
// its now perfect time to add some error handlers or routes that will not conflict with controllers.
});
};
Your controllers can be even more controlled via hooks. Read more below for before and after
@Controller('/')
class Controller {
async before(req, res, next) {
// check acl, push to logs or whatever needed to do before we continue the request
next(); // dont forget this if you want to continue the request.
}
}
@Controller('/')
class Controller {
after() {
// nothing more to do,
// request already sent to client. but maybe you want to log something.
}
}
There are many ways to configure hot-controller:
Create a .controllersrc.json
.json, .json5, .yaml/.yml (just append extension to .controllersrc, ex: .controllersrc.yml)Add controllers section to your package.json file.
{
/**
* where is your controllers?
* type: string
* default: ./controllers
*/
"dir": "",
/**
* sets the root path for controllers (example: /api)
* type: string
* default: /
*/
"path": "/api",
/**
* use plugins
* type: string[], func[]
*/
"plugins": []
}
via .controllersrc.json
{
"dir": "./api"
}
in package.json
{
...
"controllers": {
"dir": "./api",
},
...
}
hot-controller allows for custom .babelrc for your controllers. This file is optional.
In order to extend our usage of babel, you can simply define a .babelrc file at the root of your app or in your controllers directory.
Thanks goes to these wonderful people (emoji key):
Philip Oliver 💻 📖 🤔 👀 ⚠️ 🔧 | Viktor S 📖 💻 | an90dr 📖 | Umang G. Patel 📖 |
|---|
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
hot-controller is a zero-config, hot-reloading controller library for node.js.
We found that hot-controller demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.