
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
Promise based, easy to use, with built-in multipart/form-data and gzip/deflate handling support - yet another request library (yarl)
YARL, Carl!
Promise based, easy to use, with built-in multipart/form-data and gzip/deflate handling support - yet another request library (yarl).
Promise based (i.e. async/await ready)multipart/form-data built-in supportjson parsegzip/deflate handlingdownload method$ npm install yarl --save
const { get, download } = require('yarl');
get('https://api.github.com/users/strikeentco', { json: true })
.then(({body}) => {
body.name; // -> Alexey Bystrov
return download(body.avatar_url, `./${body.login}.jpg`);
})
.then((res) => {
res.body; // -> The data successfully written to file.
});
const { post } = require('yarl');
const { createReadStream } = require('fs');
const { get } = require('https');
post('127.0.0.1:3000', {
body: {
photo: get('https://avatars.githubusercontent.com/u/2401029'),
fixture: createReadStream('./test/fixture/fixture.jpg')
},
multipart: true
});
By default it's a GET request, but you can change it in options.
If http:// will be missed in url, it will be automatically added.
http.request options object.http.request options options and:
urlencoded string or query Object. Object will be stringified with querystring.stringify. This will override the query string in url.POST, PUT, PATCH, DELETE request. If content-length or transfer-encoding is not set in options.headers, transfer-encoding will be set as chunked.true, body object will be sent as multipart/form-data.true, body object will be sent as application/x-www-form-urlencoded.true, body object will be sent as application/json. Parse response body with JSON.parse and set accept header to application/json. If used in conjunction with the form option, the body will the stringified as querystring and the response parsed as JSON.true, will follow redirects for all methods, otherwise for GET and HEAD only.true, headers property will be added to response object, otherwise only body will.true, the body is returned as a Buffer.WritableStream or new WritableStream will be created with specified path.gzip. Useful when server doesn't specify Content-Encoding header.deflate. Useful when server doesn't specify Content-Encoding header.Simmilar to yarl(url, { method: 'GET' }).
Simmilar to yarl(url, { method: 'HEAD', includeHeaders: true }).
Simmilar to yarl(url, { method: 'POST' }).
Simmilar to yarl(url, { method: 'PUT' }).
Simmilar to yarl(url, { method: 'PATCH' }).
Simmilar to yarl(url, { method: 'DELETE' }).
Simmilar to yarl(url, { method: 'GET', download: path }).
You can use the xml-parser module to parse XML data:
const yarl = require('yarl');
const parse = require('xml-parser');
function xmlParse(xml) {
return Object.assign({}, xml, {
body: parse(xml.body)
});
}
yarl('http://api.openweathermap.org/data/2.5/weather?q=London&mode=xml').then(xmlParse).then((r) => {
r.body.root.children[1].attributes.value; // -> temperature
});
// or
yarl('http://api.openweathermap.org/data/2.5/weather?q=London&mode=xml').then((r) => {
parse(r.body).root.children[1].attributes.value; // -> temperature
});
You can use the tunnel module with the agent option to work with proxies:
const yarl = require('yarl');
const tunnel = require('tunnel');
yarl('github.com', {
agent: tunnel.httpOverHttp({
proxy: {
host: 'localhost'
}
})
});
You can use the cookie module to include cookies in a request:
const yarl = require('yarl');
const cookie = require('cookie');
yarl('github.com', {
headers: {
cookie: cookie.serialize('foo', 'bar')
}
});
You can use the oauth-1.0a module to create a signed OAuth request:
const yarl = require('yarl');
const crypto = require('crypto');
const OAuth = require('oauth-1.0a');
const oauth = OAuth({
consumer: {
key: process.env.CONSUMER_KEY,
secret: process.env.CONSUMER_SECRET
},
signature_method: 'HMAC-SHA1',
hash_function: (baseString, key) => crypto.createHmac('sha1', key).update(baseString).digest('base64')
});
const token = {
key: process.env.ACCESS_TOKEN,
secret: process.env.ACCESS_TOKEN_SECRET
};
const url = 'https://api.twitter.com/1.1/statuses/home_timeline.json';
yarl(url, {
headers: oauth.toHeader(oauth.authorize({ url, method: 'GET' }, token)),
json: true
});
const yarl = require('yarl');
(async () => {
const { body: photo } = await yarl('https://avatars.githubusercontent.com/u/2401029', { buffer: true });
await yarl('127.0.0.1:3000', { body: { photo }, multipart: true })
})()
const { createReadStream } = require('fs');
const { get } = require('https');
const { post } = require('yarl');
const options = {
body: {
photo: {
value: [
createReadStream('./test/fixture/fixture.jpg'),
get('https://avatars.githubusercontent.com/u/2401029')
],
options: { filename: 'photo.jpg' }
},
field: [1, 2, '3', 4, null]
},
multipart: true,
json: true
};
post('127.0.0.1:3000', options);
The MIT License (MIT)
Copyright (c) 2015-2017 Alexey Bystrov
FAQs
Promise based, easy to use, with built-in multipart/form-data and gzip/deflate handling support - yet another request library (yarl)
We found that yarl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.