Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Early in Node.js I wrote an HTTP client library called request
. It evolved
along with Node.js and eventually became very widely depended upon.
A lot has changed since 2010 and I've decided to re-think what a simple HTTP client library should look like.
This new library, r2
, is a completely new approach from request
.
r2
is built on top of the browser's
Fetch API and shimmed for Node.js.const r2 = require('r2')
let html = await r2('https://www.google.com').text
Simple JSON support.
let obj = {ok: true}
let resp = await r2.put('http://localhost/test.json', {json: obj}).json
Simple headers support.
let headers = {'x-test': 'ok'}
let res = await r2('http://localhost/test', {headers}).response
Being written to the Fetch API is a huge benefit for browser users.
When running through browserify request
is ~2M uncompressed and ~500K compressed. r2
is only 66K uncompressed and 16K compressed.
FAQs
HTTP client. Spiritual successor to request.
The npm package r2 receives a total of 36,538 weekly downloads. As such, r2 popularity was classified as popular.
We found that r2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.