
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
All over again. Includes support for xmlHttpRequest, JSONP, CORS, and CommonJS Promises A.
It is also isomorphic allowing you to require('reqwest') in Node.js through the peer dependency xhr2, albeit the original intent of this library is for the browser. For a more thorough solution for Node.js, see mikeal/request.
reqwest('path/to/html', function (resp) {
qwery('#content').html(resp)
})
reqwest({
url: 'path/to/html'
, method: 'post'
, data: { foo: 'bar', baz: 100 }
, success: function (resp) {
qwery('#content').html(resp)
}
})
reqwest({
url: 'path/to/html'
, method: 'get'
, data: [ { name: 'foo', value: 'bar' }, { name: 'baz', value: 100 } ]
, success: function (resp) {
qwery('#content').html(resp)
}
})
reqwest({
url: 'path/to/json'
, type: 'json'
, method: 'post'
, error: function (err) { }
, success: function (resp) {
qwery('#content').html(resp.content)
}
})
reqwest({
url: 'path/to/json'
, type: 'json'
, method: 'post'
, contentType: 'application/json'
, headers: {
'X-My-Custom-Header': 'SomethingImportant'
}
, error: function (err) { }
, success: function (resp) {
qwery('#content').html(resp.content)
}
})
// Uses XMLHttpRequest2 credentialled requests (cookies, HTTP basic auth) if supported
reqwest({
url: 'path/to/json'
, type: 'json'
, method: 'post'
, contentType: 'application/json'
, crossOrigin: true
, withCredentials: true
, error: function (err) { }
, success: function (resp) {
qwery('#content').html(resp.content)
}
})
reqwest({
url: 'path/to/data.jsonp?callback=?'
, type: 'jsonp'
, success: function (resp) {
qwery('#content').html(resp.content)
}
})
reqwest({
url: 'path/to/data.jsonp?foo=bar'
, type: 'jsonp'
, jsonpCallback: 'foo'
, jsonpCallbackName: 'bar'
, success: function (resp) {
qwery('#content').html(resp.content)
}
})
reqwest({
url: 'path/to/data.jsonp?foo=bar'
, type: 'jsonp'
, jsonpCallback: 'foo'
, success: function (resp) {
qwery('#content').html(resp.content)
}
, complete: function (resp) {
qwery('#hide-this').hide()
}
})
reqwest({
url: 'path/to/data.jsonp?foo=bar'
, type: 'jsonp'
, jsonpCallback: 'foo'
})
.then(function (resp) {
qwery('#content').html(resp.content)
}, function (err, msg) {
qwery('#errors').html(msg)
})
.always(function (resp) {
qwery('#hide-this').hide()
})
reqwest({
url: 'path/to/data.jsonp?foo=bar'
, type: 'jsonp'
, jsonpCallback: 'foo'
})
.then(function (resp) {
qwery('#content').html(resp.content)
})
.fail(function (err, msg) {
qwery('#errors').html(msg)
})
.always(function (resp) {
qwery('#hide-this').hide()
})
var r = reqwest({
url: 'path/to/data.jsonp?foo=bar'
, type: 'jsonp'
, jsonpCallback: 'foo'
, success: function () {
setTimeout(function () {
r
.then(function (resp) {
qwery('#content').html(resp.content)
}, function (err) { })
.always(function (resp) {
qwery('#hide-this').hide()
})
}, 15)
}
})
url a fully qualified urimethod http method (default: GET)headers http headers (default: {})data entity body for PATCH, POST and PUT requests. Must be a query String or JSON objecttype a string enum. html, xml, json, or jsonp. Default is inferred by resource extension. Eg: .json will set type to json. .xml to xml etc.contentType sets the Content-Type of the request. Eg: application/jsoncrossOrigin for cross-origin requests for browsers that support this feature.success A function called when the request successfully completeserror A function called when the request fails.complete A function called whether the request is a success or failure. Always called when complete.jsonpCallback Specify the callback function name for a JSONP request. This value will be used instead of the random (but recommended) name automatically generated by reqwest.If you are still requiring support for IE6/IE7, consider including JSON3 in your project. Or simply do the following
<script>
(function () {
if (!window.JSON) {
document.write('<scr' + 'ipt src="http://cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/json3.min.js"><\/scr' + 'ipt>')
}
}());
</script>
$ git clone git://github.com/ded/reqwest.git reqwest
$ cd !$
$ npm install
Please keep your local edits to src/reqwest.js.
The base ./reqwest.js and ./reqwest.min.js will be built upon releases.
make test
Reqwest can be used as an Ender module. Add it to your existing build as such:
$ ender add reqwest
Use it as such:
$.ajax({ ... })
Serialize things:
$(form).serialize() // returns query string -> x=y&...
$(form).serialize({type:'array'}) // returns array name/value pairs -> [ { name: x, value: y}, ... ]
$(form).serialize({type:'map'}) // returns an object representation -> { x: y, ... }
$(form).serializeArray()
$.toQueryString({
foo: 'bar'
, baz: 'thunk'
}) // returns query string -> foo=bar&baz=thunk
Or, get a bit fancy:
$('#myform input[name=myradios]').serialize({type:'map'})['myradios'] // get the selected value
$('input[type=text],#specialthing').serialize() // turn any arbitrary set of form elements into a query string
Use the request.ajaxSetup to predefine a data filter on all requests. See the example below that demonstrates JSON hijacking prevention:
$.ajaxSetup({
dataFilter: function (response, type) {
if (type == 'json') return response.substring('])}while(1);</x>'.length)
else return response
}
})
Reqwest can also be used with RequireJs and can be installed via jam
jam install reqwest
define(function(require){
var reqwest = require('reqwest')
});
Reqwest can also be installed via spm
spm install reqwest
There are some differences between the Reqwest way and the jQuery/Zepto way.
jQuery/Zepto use type to specify the request method while Reqwest uses
method and reserves type for the response data type.
When using jQuery/Zepto you use the dataType option to specify the type
of data to expect from the server, Reqwest uses type. jQuery also can
also take a space-separated list of data types to specify the request,
response and response-conversion types but Reqwest uses the type
parameter to infer the response type and leaves conversion up to you.
Reqwest also takes optional jsonpCallback and jsonpCallbackName
options to specify the callback query-string key and the callback function
name respectively while jQuery uses jsonp and jsonpCallback for
these same options.
But fear not! If you must work the jQuery/Zepto way then Reqwest has a wrapper that will remap these options for you:
reqwest.compat({
url: 'path/to/data.jsonp?foo=bar'
, dataType: 'jsonp'
, jsonp: 'foo'
, jsonpCallback: 'bar'
, success: function (resp) {
qwery('#content').html(resp.content)
}
})
// or from Ender:
$.ajax.compat({
...
})
If you want to install jQuery/Zepto compatibility mode as the default then simply place this snippet at the top of your code:
$.ajax.compat && $.ender({ ajax: $.ajax.compat });
Happy Ajaxing!
FAQs
A wrapper for asynchronous http requests
The npm package reqwest receives a total of 17,466 weekly downloads. As such, reqwest popularity was classified as popular.
We found that reqwest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.