
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Scans through the specified directory and builts endpoints that are then added to an Express app.
Scans through the specified directory and builds endpoints that are then added to an Express app.
Each API endpoint is crafted by merely by giving it the name of the HTTP method it handles.
Synth-api is one of the major features provided by the Synth framework but is made available here for people who just want a stripped down module, and not the rest of the Synth framework (which includes support for asset compilation and more fun things).
Within your request handlers, you can either return data that will be JSONified and sent back to the client (useful for stubbing during development), a promise that will then return such data, or call the methods on the Express response object directly. See the examples below.
app.js:
var express = require('express');
var synthApi = require('synth-api');
var app = express();
synthApi.generateHandlers({
resourceDir: __dirname + '/resources', // This is the default, not required
prefix: '/api', // This is the default, not required
app: app,
timeout: 300
});
app.listen(80);
resources/tweets/tweets.js
// Return data directly, useful for stubbing during development
exports.getIndex = function (req, res) {
return {
tweets: [
{
message: "Fake tweet!",
createdAt: new Date()
}
]
};
};
// Return a promise!
exports.get = function (req, res) {
var id = req.params.id;
return req.db.collection('tweets').findOne({
id: id
}).then(function (data) {
return {
tweet: data
};
});
};
// Or talk directly to Express response object
exports.post = function (req, res) {
req.db.collection('tweets').insert({
message: req.body.message,
createdAt: new Date()
}, function (err, data) {
if (err) {
res.status(500).send("Something went wrong: " + err.message);
} else {
res.send(data);
}
});
};
The above will create request handlers for the following routes:
GET /api/tweetsGET /api/tweets/:idPOST /api/tweetsYou can also create nested resources, handlers for PUT and DELETE, as well as custom actions. Learn more at (synthjs.com)[http://www.synthjs.com/docs/#creating-api-endpoints]
An object with the following keys (all are optional).
| option | Type | Default | What it does |
|---|---|---|---|
| prefix | String | '/api' | Specifies what should precede the resource name for the generated routes. |
| resourceDir | String | process.cwd() + '/resources' | The directory to look into for generating the API endpoints. |
| app | ExpressApp | null | If given an Express app, it will have the API and view endpoints automatically attached. |
| timeout | Number | 5000 | Time (in milliseconds) before an error response is returned to the client instead of the expected result. |
| catchAll | Function | null | An optional Express style request handler to handle any requests to the api path that are not handled (regardless of HTTP method). Can be used to return a custom 404 error. Note: This function should not return data or a promise. It should use the Express response object directly. |
generateHandlers() returns an object with a 'handers' key, which is an array of all the API handlers generated.
Each handler object contains the following keys:
'/api/tweets''getIndex'['tweets', 'comments'].For this, just check out the existing Synth Documentation.
FAQs
Scans through the specified directory and builts endpoints that are then added to an Express app.
We found that synth-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.