
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
trough /trôf/ — a channel used to convey a liquid.
trough is like ware with less sugar, and middleware
functions can change the input of the next.
npm:
npm install trough
var fs = require('fs')
var path = require('path')
var trough = require('trough')
var pipeline = trough()
.use(function(fileName) {
console.log('Checking... ' + fileName)
})
.use(function(fileName) {
return path.join(process.cwd(), fileName)
})
.use(function(filePath, next) {
fs.stat(filePath, function(err, stats) {
next(err, {filePath, stats})
})
})
.use(function(ctx, next) {
if (ctx.stats.isFile()) {
fs.readFile(ctx.filePath, next)
} else {
next(new Error('Expected file'))
}
})
pipeline.run('readme.md', console.log)
pipeline.run('node_modules', console.log)
Yields:
Checking... readme.md
Checking... node_modules
Error: Expected file
at ~/example.js:21:12
at wrapped (~/node_modules/trough/index.js:93:19)
at next (~/node_modules/trough/index.js:56:24)
at done (~/node_modules/trough/index.js:124:12)
at ~/node_modules/example.js:14:7
at FSReqWrap.oncomplete (fs.js:153:5)
null <Buffer 23 20 74 72 6f 75 67 68 20 5b 21 5b 42 75 69 6c 64 20 53 74 61 74 75 73 5d 5b 74 72 61 76 69 73 2d 62 61 64 67 65 5d 5d 5b 74 72 61 76 69 73 5d 20 5b ... >
trough()Create a new Trough.
TroughA pipeline.
Trough#run([input..., ]done)Run the pipeline (all use()d middleware). Invokes done
on completion with either an error or the output of the last middleware
Note! as the length of input defines whether async function get a
nextfunction, it’s recommended to keepinputat one value normally.
function done(err?, [output...])The final handler passed to run(), invoked with an error
if a middleware function rejected, passed, or threw one, or
the output of the last middleware function.
Trough#use(fn)Add fn, a middleware function, to the pipeline.
function fn([input..., ][next])A middleware function invoked with the output of its predecessor.
If fn returns or throws an error, the pipeline fails and done is
invoked with that error.
If fn returns a value (neither null nor undefined), the first
input of the next function is set to that value (all other input
is passed through).
The following example shows how returning an error stops the pipeline:
var trough = require('trough')
trough()
.use(function(val) {
return new Error('Got: ' + val)
})
.run('some value', console.log)
Yields:
Error: Got: some value
at ~/example.js:5:12
...
The following example shows how throwing an error stops the pipeline:
var trough = require('trough')
trough()
.use(function(val) {
throw new Error('Got: ' + val)
})
.run('more value', console.log)
Yields:
Error: Got: more value
at ~/example.js:5:11
...
The following example shows how the first output can be modified:
var trough = require('trough')
trough()
.use(function(val) {
return 'even ' + val
})
.run('more value', 'untouched', console.log)
Yields:
null 'even more value' 'untouched'
If fn returns a promise, and that promise rejects, the pipeline fails
and done is invoked with the rejected value.
If fn returns a promise, and that promise resolves with a value
(neither null nor undefined), the first input of the next function
is set to that value (all other input is passed through).
The following example shows how rejecting a promise stops the pipeline:
var trough = require('trough')
trough()
.use(function(val) {
return new Promise(function(resolve, reject) {
reject('Got: ' + val)
})
})
.run('val', console.log)
Yields:
Got: val
The following example shows how the input isn’t touched by resolving
to null.
var trough = require('trough')
trough()
.use(function() {
return new Promise(function(resolve) {
setTimeout(function() {
resolve(null)
}, 100)
})
})
.run('Input', console.log)
Yields:
null 'Input'
If fn accepts one more argument than the given input, a next
function is given (after the input). next must be called, but doesn’t
have to be called async.
If next is given a value (neither null nor undefined) as its first
argument, the pipeline fails and done is invoked with that value.
If next is given no value (either null or undefined) as the first
argument, all following non-nully values change the input of the following
function, and all nully values default to the input.
The following example shows how passing a first argument stops the pipeline:
var trough = require('trough')
trough()
.use(function(val, next) {
next(new Error('Got: ' + val))
})
.run('val', console.log)
Yields:
Error: Got: val
at ~/example.js:5:10
The following example shows how more values than the input are passed.
var trough = require('trough')
trough()
.use(function(val, next) {
setTimeout(function() {
next(null, null, 'values')
}, 100)
})
.run('some', console.log)
Yields:
null 'some' 'values'
The async package provides utilities for working with asynchronous JavaScript, including a series of functions similar to trough's middleware pipeline. However, async offers a broader range of patterns for handling asynchronous operations, such as parallel, series, and waterfall, which are more general-purpose compared to trough's focused middleware pipeline approach.
Express is a web application framework for Node.js, known for its use of middleware functions to process HTTP requests. While Express is specifically designed for building web applications and APIs, it shares the concept of middleware pipelines with trough. However, trough is more generic and not limited to web contexts, making it more versatile for different types of pipelines.
FAQs
`trough` is middleware
The npm package trough receives a total of 6,780,480 weekly downloads. As such, trough popularity was classified as popular.
We found that trough demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.