
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
Node.js/TypeScript HTTP client with browser TLS fingerprint impersonation (JA3/JA4). Bypass Cloudflare and anti-bot detection. Rust-powered, fetch()-compatible.
wreq-js is a Node.js and TypeScript HTTP client that helps you bypass TLS fingerprinting checks used by services like Cloudflare and DataDome, powered by native Rust bindings from wreq.
If your requests work in a browser but get blocked from Node.js because your network fingerprint looks wrong, this is for you. You keep a fetch style API and get browser profile level network behavior without running a full browser.
Common search terms: cloudflare bypass, datadome bypass, tls fingerprinting, ja3, ja4, browser impersonation, nodejs fetch, typescript http client.
| Library | Approach | API | Notes |
|---|---|---|---|
| wreq-js | Rust native bindings (wreq) | Fetch style, TypeScript first | Profile labels and network behavior come from the native layer |
| CycleTLS | Go subprocess bridge | Promise based | Subprocess model |
| got-scraping | JavaScript HTTP client customization | got based | Header and request customization |
| node-tls-client | Native shared library bindings | Custom | Behavior depends on upstream native layer |
| curl-impersonate | curl based tooling | CLI and bindings | Binary/tooling workflow |
All guides, concepts, and API reference live at:
(If you're looking for examples, sessions/cookies, proxy usage, streaming, WebSockets, or the full API surface - it's all there.)
Quick links:
npm install wreq-js
# or
yarn add wreq-js
pnpm add wreq-js
bun add wreq-js
Current configured native target matrix in package.json includes:
If a matching prebuilt artifact is unavailable for your environment, installation may build from source (requires a Rust toolchain).
import { fetch } from 'wreq-js';
const res = await fetch('https://example.com/api', {
browser: 'chrome_142',
os: 'windows',
});
console.log(await res.json());
By default, standalone fetch() calls use isolated ephemeral cookie storage.
Use createSession() when you want cookie persistence across requests.
For most real-world workloads, start with a session and reuse it across requests. This keeps one cookie and request context for multi step flows.
import { createSession } from 'wreq-js';
const session = await createSession({ browser: 'chrome_142', os: 'windows' });
try {
const a = await session.fetch('https://example.com/a');
const b = await session.fetch('https://example.com/b');
console.log(a.status, b.status);
} finally {
await session.close();
}
More session patterns: https://wreq.sqdsh.win
Use the helper for a connected socket from one await.
import { websocket } from 'wreq-js';
const ws = await websocket('wss://example.com/ws', {
browser: 'chrome_142',
headers: {
Authorization: 'Bearer token',
},
});
ws.onmessage = (event) => {
console.log(event.data);
};
ws.send('hello');
ws.close(1000, 'done');
Use the constructor when you want browser like CONNECTING behavior.
import { WebSocket } from 'wreq-js';
const ws = new WebSocket('wss://example.com/ws', {
browser: 'chrome_142',
os: 'windows',
});
ws.onopen = () => {
void ws.send('connected');
};
Use session.websocket(...) to reuse cookies and transport settings from session HTTP calls.
import { createSession } from 'wreq-js';
const session = await createSession({ browser: 'chrome_142' });
try {
await session.fetch('https://example.com/login', {
method: 'POST',
body: new URLSearchParams({ user: 'name', pass: 'secret' }),
});
const ws = await session.websocket('wss://example.com/ws');
ws.onmessage = (event) => {
console.log(event.data);
};
} finally {
await session.close();
}
Use wreq-js when your Node.js HTTP or WebSocket traffic gets blocked because of TLS fingerprinting or browser profile mismatches.
It is a good fit when you want Cloudflare bypass and DataDome bypass style network behavior with a familiar fetch style API.
It handles transport and fingerprint level behavior, not CAPTCHA solving and not in page JavaScript execution.
If you need DOM/JS execution, CAPTCHA solving, or full browser automation, use Playwright/Puppeteer instead.
Why use sessions? Use sessions for multi-step flows where cookie and request context should be shared.
Why does install compile from source on some machines? If a matching prebuilt native artifact is unavailable, npm may build from source.
Can I use per-request proxy overrides inside a session?
Yes, by passing a transport on that specific session.fetch(...) call. The proxy field itself remains session-scoped.
See CONTRIBUTING.md.
This is a maintained fork of will-work-for-meal/node-wreq (originally named node-wreq), with ongoing updates, compatibility fixes, and performance work.
FAQs
Node.js/TypeScript HTTP client with browser TLS fingerprint impersonation (JA3/JA4). Bypass Cloudflare and anti-bot detection. Rust-powered, fetch()-compatible.
The npm package wreq-js receives a total of 6,753 weekly downloads. As such, wreq-js popularity was classified as popular.
We found that wreq-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.