
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
one-firework
Advanced tools
Explode once. Never again.
💡 A single-execution function utility — type-safe, side-effect-proof, and featherlight.
one-firework ensures your function runs exactly once, no matter how many times it’s called. Perfect for initializations, expensive computations, or preventing repeated side effects. All with type safety, reset control, and zero bloat. Control the way your code runs.
⚡bun add one-firework
or
📦npm install one-firework ~ 🚀 Classic launch
🐈yarn add one-firework ~ 🎇 Smooth glide
import firework from 'one-firework'
function expensiveCalculation(a: number, b: number): number {
console.log("Performing expensive calculation...");
return a + b;
}
const onceCalculation = firework(expensiveCalculation);
onceCalculation(5, 3); // 👉 8
onceCalculation(9, 1); // 👉 8 (ignored)
onceCalculation(2, 3); // 👉 8 (still ignored)
firework.fired(onceCalculation); // 👉 3 (calls tracked)
throwOnMaxCallsconst runOnce = firework(expensiveCalculation, { throwOnMaxCalls: true });
runOnce(1, 2); // ✅ Executes
runOnce(3, 4); // ❌ Throws: function already called
Returns a function that invokes func only on the first call.
Type: Function -
The function to protect from repeated execution.
Type: Object
Type: boolean,
Default: false
If true, calling more than once throws an error.
Returns the number of times the function was called.
ℹ️ Note: This only works when the function is wrapped with firework.
⏳ Coming soon: You'll be able to call .fired directly on the function (fn.fired) without needing to wrap it!
Sometimes, you only want the fuse to burn once — like:
Let one-firework handle that — beautifully, safely, and with a little style. 🧨
FAQs
A library for singal use function execution.
We found that one-firework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.