
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Manipulate the HTTP Vary header
This is a Node.js module available through the
npm registry. Installation is done using the
npm install
command:
$ npm install vary
var vary = require('vary')
Adds the given header field
to the Vary
response header of res
.
This can be a string of a single field, a string of a valid Vary
header, or an array of multiple fields.
This will append the header if not already listed, otherwise leaves it listed in the current location.
// Append "Origin" to the Vary header of the response
vary(res, 'Origin')
Adds the given header field
to the Vary
response header string header
.
This can be a string of a single field, a string of a valid Vary
header,
or an array of multiple fields.
This will append the header if not already listed, otherwise leaves it listed in the current location. The new header string is returned.
// Get header string appending "Origin" to "Accept, User-Agent"
vary.append('Accept, User-Agent', 'Origin')
var http = require('http')
var vary = require('vary')
http.createServer(function onRequest (req, res) {
// about to user-agent sniff
vary(res, 'User-Agent')
var ua = req.headers['user-agent'] || ''
var isMobile = /mobi|android|touch|mini/i.test(ua)
// serve site, depending on isMobile
res.setHeader('Content-Type', 'text/html')
res.end('You are (probably) ' + (isMobile ? '' : 'not ') + 'a mobile user')
})
$ npm test
The 'fresh' package is an HTTP response freshness testing library that evaluates whether a response is still 'fresh' in the context of request and response headers. It is similar to 'vary' in that it deals with HTTP headers, but 'fresh' focuses on cache validation while 'vary' focuses on managing the Vary header.
The 'negotiator' package is an HTTP content negotiation library that supports media types, charsets, encodings, languages, and more. It is similar to 'vary' in that it assists with content negotiation, but 'negotiator' provides a higher-level API for selecting the best response based on the client's request, whereas 'vary' is specifically for manipulating the Vary header.
FAQs
Manipulate the HTTP Vary header
The npm package vary receives a total of 34,564,149 weekly downloads. As such, vary popularity was classified as popular.
We found that vary demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.