
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
expose the raw request data in an http server
var createServer = require('http-raw');
var through = require('through');
var server = createServer(function (req, res) {
if (req.method === 'GET') {
res.end('beep boop\n');
}
else {
var rs = req.createRawBodyStream();
var ws = res.createRawStream();
ws.write('HTTP/1.1 200 OK\r\n\r\n');
rs.pipe(upper()).pipe(ws)
}
});
server.listen(7000);
function upper () {
return through(function (buf) {
this.emit('data', String(buf).toUpperCase());
});
}
$ node example/server.js &
$ nc localhost 7000
PUT / HTTP/1.1
Host: robots
HTTP/1.1 200 OK
beep
BEEP
boop
BOOP
var httpRaw = require('http-raw')
The http-raw api is exactly like the http.createServer(cb) api from core,
except for the extra functions documented below that get attached to the req
and res objects in the
'request'
and
'upgrade'
events.
Create a new http server with extended raw stream functions.
Create a new https server with extended raw stream functions.
Return a readable stream rs. rs will emit all the raw data from the
connection, including the buffered header data without doing any parsing on the
data beforehand.
On the same tick as the response handler, s.buffers will contain an array of
all the buffered data.
On the next tick s.buffers gets set to undefined to it can be garbage
collected.
To get all the data, req.createRawStream() must be fired on the same tick as
the response callback.
Return a writable stream ws that will be written directly to the underlying
network socket without any additional framing added.
Return a readable stream bs like the stream returned by
req.createRawStream(), but only emit the raw body data, not the headers.
To get all the data, req.createRawBodyStream() must be fired on the same tick
as the response callback.
With npm do:
npm install http-raw
MIT
FAQs
expose the raw request data in an http server
The npm package http-raw receives a total of 18 weekly downloads. As such, http-raw popularity was classified as not popular.
We found that http-raw demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.