
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
**TempBox** is a lightweight, in-memory key-value store for Node.js with built-in TTL (time-to-live) support and proactive expiration. It's not a cache—it's a tiny ephemeral store that keeps your data just long enough, and then lets it go.
TempBox is a lightweight, in-memory key-value store for Node.js with built-in TTL (time-to-live) support and proactive expiration. It's not a cache—it's a tiny ephemeral store that keeps your data just long enough, and then lets it go.
setTimeout, not lazy)onExpire callbacktinyqueue)npm install tempbox
import { TempBox } from "tempbox";
const store = new TempBox();
store.set("session:123", { userId: 1 }, 3000); // expires in 3 seconds
store.set("token:abc", "xyz"); // no expiration
console.log(store.get("session:123")); // { userId: 1 }
setTimeout(() => {
console.log(store.get("session:123")); // undefined (expired)
}, 3100);
You can provide a callback that runs when keys expire:
const store = new TempBox({
onExpire: (key, value) => {
console.log(`Expired: ${key} →`, value);
},
});
new TempBox(options?)Creates a new instance of the store.
| Option | Type | Default | Description |
|---|---|---|---|
onExpire | (key: string, value: any) => void | undefined | Callback invoked when a key expires |
store.set(key: string, value: any, ttlMs?: number): voidStores a key with an optional TTL in milliseconds. If no TTL is provided, the value will not expire automatically.
store.get(key: string): any | undefinedReturns the stored value if it exists and hasn't expired.
If the key has expired, it will be removed and undefined is returned.
store.has(key: string): booleanReturns true if the key exists and hasn't expired, false otherwise.
store.delete(key: string): booleanManually removes a key.
Returns true if the key existed and was deleted, false otherwise.
store.stop(): voidStops the internal expiration timers. Useful for graceful shutdown or during testing.
TempBox is not a cache. It's not optimized for size or eviction strategies (e.g. LRU). It's built for situations where you just want to store small pieces of data for a limited time, entirely in memory.
TempBox only uses tinyqueue internally for efficient scheduling of expirations. No other dependencies.
MIT 2025 - José F. Romaniello
FAQs
**TempBox** is a lightweight, in-memory key-value store for Node.js with built-in TTL (time-to-live) support and proactive expiration. It's not a cache—it's a tiny ephemeral store that keeps your data just long enough, and then lets it go.
We found that tempbox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.