
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
reference-fetcher
Advanced tools
ReferenceFetcher is a simple-to-use JS library to fetch entity references.
npm install --save reference-fetcher
ReferenceFetcher is an algorithm useful for retrieving multiple referenced entity from a database.
Imagine we have this kind of database:

Posts is the key database table here. A post has 3 references; a tag, a creator and a subreddit which correspond to IDs that we can find in the corresponding database tables.
Note: ReferenceFetcher is made to work with only unique references up to now, do not use it to fetch an array of reference (i.e. a Post should have only one tag, one creator and one subreddit in our example). Array may come as a feature in the near future.
Our workflow is to get a particular set of Posts (to feed a page or whatever) and its references but we do not want the Back-End to populate them for us for three reasons:
That's where ReferenceFetcher shines. Thanks to a configuration object, we can declare what references we want to fetch and it will call our Promises with the correct parameters plus taking care of duplication. Then it is up to us to populate correctly our store with our Promises results. At Wing we use Redux dispatch from our Promises (which are actions) result to populate our stores. Promises must always returns their results after the operation you have done.
import referenceFetcher from 'reference-fetcher'
const configuration = {
entity: 'posts',
fetch: () => getPosts(),
rootNoCache: true,
refs: [{
entity: 'subreddit',
fetch: subredditId => getSubreddit(subredditId),
}, {
entity: 'subscribers',
relationName: 'creator',
batch: true,
fetch: subscribersIds => getSubscribers(subscribersIds),
refs: [{
entity: 'stats',
relationName: 'stat',
batch: true,
fetch: getStats,
}]
}, {
entity: 'tag',
noCache: true,
fetch: getTag,
}],
sides: [{ // Optional: useful to retrieve entity by post ids
entity: 'notLinked',
fetch: postIds => getNotLinkedEntity(postIds),
}]
}
referenceFetcher(configuration)
Example of actions used:
const getPosts = () => new Promise((resolve, reject) => {
// Retrieve posts from your api
fetch(`${APIURL}/posts`).then(response => {
// Populate your store
postsStore.push(...response.posts)
// Return the response allowing to fetch underneath references
// and chain our promise
return response.posts
})
})
const getSubreddit = subredditId => new Promise((resolve, reject) => {
fetch(`${APIURL}/subreddits/${subredditId}`).then(response => {
subredditsStore.push(response.subreddit)
return response.subreddit
})
})
const getSubscribers = subscribersId => new Promise((resolve, reject) => {
// A POST method to get a batch of subscribers, because you can
fetch(`${APIURL}/subscribers`, {
method: 'POST',
body: subscribersId
}).then(response => {
subscribersStore.push(...response.subscribers)
return response.subscribers
})
})
entity. fetch is called with no parameters if it is the root Object (Post in our example) or is called multiple times with a String representing the ID to fetch (getSubreddit in our example) or is called once with an Array of ID to fetch (getSubscribers in our example). The promise must return its results if we want lower refs to work.entity.fetchcalled only once with the array of ID to retrieve.fetch with the unique IDs it finds in the parent Object.({ entity: string, fetch: function }). Used to fetch entities that are not linked to a parent. Will use the cache.ReferenceFetcher returns nothing, its objective is only to correctly call the different Promises. We need to feed our store directly from the Promises.
This project adheres to Semantic Versioning.
You can find every release documented on the Releases page.
MIT
FAQs
Simple and easy entity references fetcher
We found that reference-fetcher demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.