
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Probe endpoints for expected responses and take action if needed
It's often necessary to probe HTTP endpoints to ensure services are available or to build health or dependency checking frameworks.
In these types of checks the following scenarios are common:
pass - the request returns a valid responsefail - the request returns an invalid responseerror - something else went wrongA probe is a simple, configurable, event-emitting object designed with this in mind. It handles building and sending requests to endpoints at specified intervals, expects given responses and emits events which can be listened to in order to take action based on the scenarios above.
npm install --save probejs
const Probe = require('probe');
// create a new probe providing any required config
const probe = new Probe({
endpoint: 'http://mydomain:1234/path/to/probe', // the endpoint to probe
interval: 30, // how often to send a request (in seconds)
validResponses: [200] // array of responses that we'll consider a 'pass'
});
// create any required event listeners
probe.on('fail', (response) => {
// take some action e.g. send an alert
});
// start the probe
probe.start();
When creating a new Probe() the constructor expects a config object which supports the following keys:
type: string
required: false
default: 'GET'
the HTTP request method to use
type: string
required: true
default: none
the endpoint to probe
supports HTTP/HTTPS, custom ports, paths and query parameters
type: object
required: false
default: none
support for basic auth & bearer tokens
Object expects the following keys:
username string (required with password, not valid with bearer)password string (required with username, not valid with bearer)bearer string (not valid with username or password)type: object
required: false
default: none
custom headers to add to the requests
type: any
required: false
default: none
a request body to send e.g. in POST requests
type: array
required: false
default: [200]
an array of responses that will be considered a pass
any response not in this array will be considered a fail
type: int
required: false
default: 30
the interval in seconds between sending requests
requests continue to be sent until probe.stop() is called
setting this to 0 is equivalent to sending a single request followed by probe.stop()
type: int
required: false
default: 10
the timeout in seconds to wait for a request to complete
note that if the underlying TCP connection cannot be established, the OS-wide TCP connection timeout will overrule the timeout option
The following events can be listened to:
start - emitted when probe.start() is calledstop - emitted when probe.stop() is callederror - emitted when an error occurred trying to send the requestcomplete - emitted at the end of every request, regardless of 'error', 'pass' or 'fail'pass - emitted when the status code of the response was in the validResponses array of the probe configfail - emitted when the status code of the response was NOT in the validResponses array in the probe configFAQs
Probe endpoints for expected responses and take action if needed
We found that probejs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.