
Research
Security News
The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
The trough npm package is a utility for creating middleware-style function pipelines. It allows you to compose and execute functions in a series, where each function can asynchronously handle data and pass it to the next function in the pipeline. This is particularly useful for processing data, handling requests in web servers, or any scenario where you need a series of operations to be performed in order.
Pipeline Creation
This code sample demonstrates how to create a new pipeline using trough. It first requires the trough package and then creates a new pipeline instance.
const trough = require('trough');
const pipeline = trough();
Adding Middleware
This code sample shows how to add a middleware function to the pipeline. The middleware function takes data and a callback function (`next`) as arguments. It modifies the data and passes it to the next middleware in the pipeline by calling `next`.
pipeline.use(function (data, next) {
// Modify data
next(null, modifiedData);
});
Executing the Pipeline
This code sample illustrates how to execute the pipeline with some initial data. It runs the pipeline and provides a callback function to handle the final result or any errors that might occur during the execution.
pipeline.run(initialData, function (err, result) {
if (err) throw err;
// Handle result
});
The async package provides utilities for working with asynchronous JavaScript, including a series of functions similar to trough's middleware pipeline. However, async offers a broader range of patterns for handling asynchronous operations, such as parallel, series, and waterfall, which are more general-purpose compared to trough's focused middleware pipeline approach.
Express is a web application framework for Node.js, known for its use of middleware functions to process HTTP requests. While Express is specifically designed for building web applications and APIs, it shares the concept of middleware pipelines with trough. However, trough is more generic and not limited to web contexts, making it more versatile for different types of pipelines.
trough
is middleware.
trough
is like ware
with less sugar.
Middleware functions can also change the input of the next.
The word trough (/trôf/
) means a channel used to convey a liquid.
You can use this package when you’re building something that accepts “plugins”, which are functions, that can be sync or async, promises or callbacks.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install trough
In Deno with esm.sh
:
import {trough, wrap} from 'https://esm.sh/trough@2'
In browsers with esm.sh
:
<script type="module">
import {trough, wrap} from 'https://esm.sh/trough@2?bundle'
</script>
import fs from 'node:fs'
import path from 'node:path'
import process from 'node:process'
import {trough} from 'trough'
const pipeline = trough()
.use(function (fileName) {
console.log('Checking… ' + fileName)
})
.use(function (fileName) {
return path.join(process.cwd(), fileName)
})
.use(function (filePath, next) {
fs.stat(filePath, function (error, stats) {
next(error, {filePath, stats})
})
})
.use(function (ctx, next) {
if (ctx.stats.isFile()) {
fs.readFile(ctx.filePath, next)
} else {
next(new Error('Expected file'))
}
})
pipeline.run('readme.md', console.log)
pipeline.run('node_modules', console.log)
Yields:
Checking… readme.md
Checking… node_modules
Error: Expected file
at ~/example.js:22:12
at wrapped (~/node_modules/trough/index.js:111:16)
at next (~/node_modules/trough/index.js:62:23)
at done (~/node_modules/trough/index.js:145:7)
at ~/example.js:15:7
at FSReqCallback.oncomplete (node:fs:199:5)
null <Buffer 23 20 74 72 6f 75 67 68 0a 0a 5b 21 5b 42 75 69 6c 64 5d 5b 62 75 69 6c 64 2d 62 61 64 67 65 5d 5d 5b 62 75 69 6c 64 5d 0a 5b 21 5b 43 6f 76 65 72 61 ... 7994 more bytes>
This package exports the identifiers
trough
and
wrap
.
There is no default export.
It exports the TypeScript types
Callback
,
Middleware
,
Pipeline
,
Run
,
and Use
.
trough()
Create new middleware.
There are no parameters.
wrap(middleware, callback)
Wrap middleware
into a uniform interface.
You can pass all input to the resulting function.
callback
is then called with the output of middleware
.
If middleware
accepts more arguments than the later given in input,
an extra done
function is passed to it after that input,
which must be called by middleware
.
The first value in input
is the main input value.
All other input values are the rest input values.
The values given to callback
are the input values,
merged with every non-nullish output value.
middleware
throws an error,
returns a promise that is rejected,
or calls the given done
function with an error,
callback
is called with that errormiddleware
returns a value or returns a promise that is resolved,
that value is the main output valuemiddleware
calls done
,
all non-nullish values except for the first one (the error) overwrite the
output valuesmiddleware
(Middleware
)
— function to wrapcallback
(Callback
)
— callback called with the output of middleware
Wrapped middleware (Run
).
Callback
Callback function (TypeScript type).
error
(Error
, optional)
— error, if any...output
(Array<unknown>
, optional)
— output valuesNothing (undefined
).
Middleware
A middleware function called with the output of its predecessor (TypeScript type).
If fn
returns or throws an error,
the pipeline fails and done
is called with that error.
If fn
returns a value (neither null
nor undefined
),
the first input
of the next function is set to that value
(all other input
is passed through).
The following example shows how returning an error stops the pipeline:
import {trough} from 'trough'
trough()
.use(function (thing) {
return new Error('Got: ' + thing)
})
.run('some value', console.log)
Yields:
Error: Got: some value
at ~/example.js:5:12
…
The following example shows how throwing an error stops the pipeline:
import {trough} from 'trough'
trough()
.use(function (thing) {
throw new Error('Got: ' + thing)
})
.run('more value', console.log)
Yields:
Error: Got: more value
at ~/example.js:5:11
…
The following example shows how the first output can be modified:
import {trough} from 'trough'
trough()
.use(function (thing) {
return 'even ' + thing
})
.run('more value', 'untouched', console.log)
Yields:
null 'even more value' 'untouched'
If fn
returns a promise,
and that promise rejects,
the pipeline fails and done
is called with the rejected value.
If fn
returns a promise,
and that promise resolves with a value (neither null
nor undefined
),
the first input
of the next function is set to that value (all other input
is passed through).
The following example shows how rejecting a promise stops the pipeline:
import {trough} from 'trough'
trough()
.use(function (thing) {
return new Promise(function (resolve, reject) {
reject('Got: ' + thing)
})
})
.run('thing', console.log)
Yields:
Got: thing
The following example shows how the input isn’t touched by resolving to null
.
import {trough} from 'trough'
trough()
.use(function () {
return new Promise(function (resolve) {
setTimeout(function () {
resolve(null)
}, 100)
})
})
.run('Input', console.log)
Yields:
null 'Input'
If fn
accepts one more argument than the given input
,
a next
function is given (after the input).
next
must be called, but doesn’t have to be called async.
If next
is given a value (neither null
nor undefined
) as its first
argument,
the pipeline fails and done
is called with that value.
If next
is given no value (either null
or undefined
) as the first
argument,
all following non-nullish values change the input of the following
function,
and all nullish values default to the input
.
The following example shows how passing a first argument stops the pipeline:
import {trough} from 'trough'
trough()
.use(function (thing, next) {
next(new Error('Got: ' + thing))
})
.run('thing', console.log)
Yields:
Error: Got: thing
at ~/example.js:5:10
The following example shows how more values than the input are passed.
import {trough} from 'trough'
trough()
.use(function (thing, next) {
setTimeout(function () {
next(null, null, 'values')
}, 100)
})
.run('some', console.log)
Yields:
null 'some' 'values'
...input
(Array<any>
, optional)
— input valuesOutput, promise, etc (any
).
Pipeline
Pipeline (TypeScript type).
Run
Call all middleware (TypeScript type).
Calls done
on completion with either an error or the output of the
last middleware.
👉 Note: as the length of input defines whether async functions get a
next
function, it’s recommended to keepinput
at one value normally.
...input
(Array<any>
, optional)
— input valuesdone
(Callback
)
— callback called when doneNothing (undefined
).
Use
Add middleware (TypeScript type).
middleware
(Middleware
)
— middleware functionCurrent pipeline (Pipeline
).
This projects is compatible with maintained versions of Node.js.
When we cut a new major release,
we drop support for unmaintained versions of Node.
This means we try to keep the current release line,
trough@2
,
compatible with Node.js 12.
This package is safe.
Yes please! See How to Contribute to Open Source.
FAQs
`trough` is middleware
The npm package trough receives a total of 0 weekly downloads. As such, trough popularity was classified as not popular.
We found that trough demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
Security News
ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.