
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A robust, high-performance TypeScript fetch wrapper with built-in retry logic, exponential backoff, streaming capabilities, and Server-Sent Events (SSE) support.
# npm
npm install stretto
# Deno
deno add jsr:@wutility/stretto
Or use the CDN:
<script src="https://cdn.jsdelivr.net/npm/stretto/dist/index.umd.min.js"></script>
<!-- window.stretto.default is available -->
import stretto from 'stretto';
// jsr
// import stretto, { JSONStreamTransformer } from "jsr:@wutility/stretto";
// Simple GET request
const response = await stretto('https://jsonplaceholder.typicode.com/todos/1');
const data = await response.json();
const response = await stretto('https://api.example.com/data', {
retries: 5,
timeout: 10000,
headers: {'Authorization': 'Bearer token'}
});
const response = await stretto('https://stream.wikimedia.org/v2/stream/recentchange', {
stream: true
});
// Use as AsyncIterable
for await (const chunk of response) {
console.log('Received chunk:', chunk);
}
import stretto, { JSONStreamTransformer } from 'stretto';
const response = await stretto('https://sse.dev/test', {
stream: true,
transformers: [new JSONStreamTransformer()]
});
for await (const event of response) {
console.log('SSE Event:', event);
}
stretto(url, options?)Main function for making HTTP requests.
Parameters:
url: string | URL - The URL to fetchoptions?: StrettoOptions - Configuration optionsReturns: Promise<StrettoStreamableResponse<T>>
interface StrettoOptions extends Omit<RequestInit, 'signal'> {
retries?: number; // Default: 3
timeout?: number; // Default: 30000ms
backoffStrategy?: (attempt: number) => number;
retryOn?: (error: unknown, response?: Response) => boolean;
stream?: boolean; // Default: false
transformers?: TransformStream<any, any>[];
signal?: AbortSignal;
}
A specialized transformer for parsing Server-Sent Events with JSON payloads.
import { JSONStreamTransformer } from 'stretto';
const transformer = new JSONStreamTransformer({
maxBuffer: 8192, // Maximum line buffer size
parseData: true, // Parse JSON automatically
donePrefix: '[DONE]', // Custom termination marker
onBufferOverflow: 'skip', // 'skip' | 'throw'
onParseError: 'skip' // 'skip' | 'throw'
});
const response = await stretto('https://api.example.com/data', {
retries: 5,
retryOn: (error, response) => {
// Custom retry logic
if (response?.status === 429) return true; // Rate limited
if (error instanceof TypeError) return true; // Network error
return false;
},
backoffStrategy: (attempt) => {
// Custom backoff: linear instead of exponential
return attempt * 1000;
}
});
const controller = new AbortController();
// Cancel after 5 seconds
setTimeout(() => controller.abort(), 5000);
try {
const response = await stretto('https://api.example.com/data', {
signal: controller.signal
});
} catch (error) {
if (error.name === 'AbortError') {
console.log('Request was cancelled');
}
}
import stretto, { JSONStreamTransformer } from 'stretto';
const response = await stretto('https://sse.dev/test', {
stream: true,
transformers: [new JSONStreamTransformer()]
});
for await (const chunk of stream) {}
npm test
Contributions are welcome! Please read our Contributing Guide for details.
MIT License - see the LICENSE file for details.
FAQs
The lightweight and The Ultimate high-performance HTTP library for WEB.
We found that stretto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.