
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
refluxo-engine
Advanced tools
A stateless, snapshot‑based, and serverless‑ready workflow engine for JavaScript.
Refluxo is a lightweight engine designed for modern distributed environments. Unlike traditional engines that "run" a process, Refluxo transitions states. It takes a snapshot, processes a step, and returns a new snapshot. This makes it the perfect backbone for "Human-in-the-loop" systems, long-running processes, and serverless architectures.
"Build your own n8n or Zapier-like automation platform with ease."
Refluxo is isomorphic. It runs wherever JavaScript runs:
Every execution step is serializable. Pause a flow, save it to a database, and resume it days later.
Refluxo supports any validation library that implements Standard Schema. You can use the popular Zod, Valibot for a small bundle size, TypeBox or ArkType for better peformance, or any other.
If you store your schema outside code, like in a database, you can write a logic to convert it to a Standard Schema object, for a example, read the docs
Uses JEXL to allow dynamic data mapping similar to n8n.
Built-in support for external triggers and manual approvals via externalPayload.
Define dynamic retry policies (fixed or exponential backoff) using expressions.
pnpm add refluxo-engine
Executors are pure logic. They receive resolved data and return an output.
import { NodeDefinition } from 'refluxo-engine';
import * as v from 'valibot'; // or any other
const httpRequest: NodeDefinition = {
input: v.object({
url: v.pipe(v.string(), v.url())
}),
async executor(data, context) {
const response = await fetch(data.url);
const json = await response.json();
return { data: json };
},
};
Workflows are plain JSON objects, making them easy to store and fetch from a frontend or database.
const workflow = {
nodes: [
{ id: 'start', type: 'http_request', data: { url: 'https://api.example.com/data' } },
data: { check: '{{ nodes.start.last.data.status === "ok" }}' }
],
edges: [
{ source: 'start', target: 'check_status' },
{ source: 'check_status', target: 'notify_node', sourceHandle: 'true' }
]
};
You can pause execution to wait for an event or manual approval.
// In your executor
async executor(data, context, externalPayload) {
if (!externalPayload) {
return { data: {}, __pause: true }; // Engine will stop here
}
return { data: externalPayload }; // Resumes with the payload
}
// Executing
const engine = new WorkflowEngine({ workflow, nodeDefinitions });
let snapshot = await engine.execute({ initialNodeId: 'start' });
// ... later, when the user approves ...
snapshot = await engine.execute({
snapshot,
externalPayload: { approvedBy: 'admin_id' }
});
Retries can be static or dynamic, driven by expressions.
const apiNode = {
type: 'api_call',
retryPolicy: {
maxAttempts: 'nodes.config.last.data.retryCount',
interval: 5000,
backoff: 'exponential'
},
// ...
};
FAQs
Stateless, snapshot-based workflow engine
We found that refluxo-engine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.