
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
response.json({result:'error',missing_keys:['email']}).status(400).pipe(res)
// headers are { 'content-type': 'application/json',
// date: 'Mon, 12 May 2014 12:57:31 GMT',
// connection: 'keep-alive',
// 'transfer-encoding': 'chunked' }
// statusCode is 400
// body is { result: 'error', missing_keys: [ 'email' ] }
The basic idea is to build request for HTTP Responses.
This whole package is still beta.
var server = http.createServer(function (req, res) {
var f = fs.createReadStream('file.js')
if (req.url === '/test.js') return f.pipe(response()).pipe(res)
})
When pipeing files to response
it will lookup the mime type and set the propert content-type header for whatever file extension you send it.
var server = http.createServer(function (req, res) {
if (req.url === '/') return response.html('<html>Hello World</html>').pipe(res)
if (req.url === '/sitemap.html') {
var f = fs.createReadStream('sitemap')
return f.pipe(response.html()).pipe(res)
}
if (req.url === '/something.json') return response.json({test:1}).pipe(res)
if (req.url === '/something.txt') return response.txt('some test').pipe(res)
})
r.error(new Error('Uh Oh!')).pipe(res)
r.error(555).pipe(res)
r.error(new Error('Uh Oh!'), 501).pipe(res)
In addition, errors emitted on the stream piped to response
will be passed through the same API and are accesssible in views
.
The compress
and gzip
keys in an options object are used for compression.
var server = http.createServer(function (req, res) {
var f = fs.createReadStream('file.js')
if (req.url === '/file.js') return f.pipe(response({compress:req})).pipe(res)
})
You can pass an HTTP Request object and the best compression, if any, will be chosen for you. Alternatively you can pass "gzip"
or "deflate"
to forcce compression of the response stream.
This compression option is compatible with every other feature in response
and will work whether you do file streaming, html, json, or even using views. When passing a view, string or buffer to response
the second argument is used as the options object.
var server = http.createServer(function (req, res) {
if (req.url === '/') return response.html('<html>Nope</html>', {compress:req}).pipe(res)
})
response
also has an extended version of node core's HTTP Response API.
All headers setting and checking is done caseless while preserving the original casing when first set. This way you never accidentally send two of the same header but can still support broken clients that check for specific caseing.
Set the statusCode property to send the HTTP status code. This is a non-destructive way to send the status code.
var r = response()
r.statusCode = 500
r.html('<html>Error</html>')
Defaults to clobbering (overwritting) existing values but when disabled will concatenate values.
r.setHeader('X-Blah', 'somehost.com')
Set multiple headers by passing an object.
r.setHeader({'x-blah': 'somehost', 'x-blah2': 'anotherhost.com'})
You can retreive a header by its key, use this method instead of directly accessing the headers object to avoid caseing constraints.
r.getHeader('content-type')
Check if a header is already set. If one is set the header key will be returned (which is important because it may have different caseing).
r.hasHeader('content-type')
function view (e, data, cb) {
if (e) return cb(e)
cb(null, '<html>' + data + '</html>')
}
var server = http.createServer(function (req, res) {
var r = response(view)
r.pipe(res)
if (req.url === '/test1') return r.html('test')
})
This is how you would easily support something like a template system. TODO: example.
Mad props to @marak who handed over the "response" package in npm that he registered way back in the day.
FAQs
Streaming and mutation API for HTTP responses.
The npm package response receives a total of 492 weekly downloads. As such, response popularity was classified as not popular.
We found that response demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.