
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@fetchkit/ffetch
Advanced tools
Fetch wrapper with configurable timeouts, retries, and TypeScript-first DX
A production-ready TypeScript-first drop-in replacement for native fetch, or any fetch-compatible implementation.
ffetch can wrap any fetch-compatible implementation (native fetch, node-fetch, undici, or framework-provided fetch), making it flexible for SSR, edge, and custom environments.
ffetch uses a plugin architecture for optional features, so you only include what you need.
Key Features:
throwOnHttpError flag to throw on HTTP errorsnpm install @fetchkit/ffetch
import { createClient } from '@fetchkit/ffetch'
import { dedupePlugin } from '@fetchkit/ffetch/plugins/dedupe'
// Create a client with timeout, retries, and deduplication plugin
const api = createClient({
timeout: 5000,
retries: 3,
plugins: [dedupePlugin()],
retryDelay: ({ attempt }) => 2 ** attempt * 100 + Math.random() * 100,
})
// Make requests
const response = await api('https://api.example.com/users')
const data = await response.json()
// Deduplication example: these two requests will be deduped
const p1 = api('https://api.example.com/data')
const p2 = api('https://api.example.com/data')
const [r1, r2] = await Promise.all([p1, p2])
// Only one fetch will occur; both promises resolve to the same response
// Example: SvelteKit, Next.js, Nuxt, or node-fetch
import { createClient } from '@fetchkit/ffetch'
// Pass your framework's fetch implementation
const api = createClient({
fetchHandler: fetch, // SvelteKit/Next.js/Nuxt provide their own fetch
timeout: 5000,
})
// Or use node-fetch/undici in Node.js
import nodeFetch from 'node-fetch'
const apiNode = createClient({ fetchHandler: nodeFetch })
// All ffetch features work identically
const response = await api('/api/data')
// Production-ready client with error handling and monitoring
import { createClient } from '@fetchkit/ffetch'
import { dedupePlugin } from '@fetchkit/ffetch/plugins/dedupe'
import { circuitPlugin } from '@fetchkit/ffetch/plugins/circuit'
const client = createClient({
timeout: 10000,
retries: 2,
fetchHandler: fetch, // Use custom fetch if needed
plugins: [
dedupePlugin({
hashFn: (params) => `${params.method}|${params.url}|${params.body}`,
ttl: 30_000,
sweepInterval: 5_000,
}),
circuitPlugin({
threshold: 5,
reset: 30_000,
onCircuitOpen: (req) => console.warn('Circuit opened due to:', req.url),
onCircuitClose: (req) => console.info('Circuit closed after:', req.url),
}),
],
hooks: {
before: async (req) => console.log('→', req.url),
after: async (req, res) => console.log('←', res.status),
onError: async (req, err) => console.error('Error:', err.message),
},
})
try {
const response = await client('/api/data')
// Check HTTP status manually (like native fetch)
if (!response.ok) {
console.log('HTTP error:', response.status)
return
}
const data = await response.json()
console.log('Active requests:', client.pendingRequests.length)
} catch (err) {
if (err instanceof TimeoutError) {
console.log('Request timed out')
} else if (err instanceof RetryLimitError) {
console.log('Request failed after retries')
}
}
throwOnHttpErrorNative fetch's controversial behavior of not throwing errors for HTTP error status codes (4xx, 5xx) can lead to overlooked errors in applications. By default, ffetch follows this same pattern, returning a Response object regardless of the HTTP status code. However, with the throwOnHttpError flag, developers can configure ffetch to throw an HttpError for HTTP error responses, making error handling more explicit and robust. Note that this behavior is affected by retries and the circuit breaker - full details are explained in the Error Handling documentation.
| Topic | Description |
|---|---|
| Complete Documentation | Start here - Documentation index and overview |
| API Reference | Complete API documentation and configuration options |
| Plugin Architecture | Plugin lifecycle, custom plugin authoring, and integration patterns |
| Deduplication | How deduplication works, hash config, optional TTL cleanup, limitations |
| Error Handling | Strategies for managing errors, including throwOnHttpError |
| Advanced Features | Per-request overrides, pending requests, circuit breakers, custom errors |
| Hooks & Transformation | Lifecycle hooks, authentication, logging, request/response transformation |
| Usage Examples | Real-world patterns: REST clients, GraphQL, file uploads, microservices |
| Compatibility | Browser/Node.js support, polyfills, framework integration |
ffetch works best with native AbortSignal.any support:
AbortSignal.any)AbortSignal.any (for example: Chrome 117+, Firefox 117+, Safari 17+, Edge 117+)If your environment does not support AbortSignal.any (Node.js < 20.6, older browsers), you can still use ffetch by installing an AbortSignal.any polyfill. AbortSignal.timeout is optional because ffetch includes an internal timeout fallback. See the compatibility guide for instructions.
Custom fetch support:
You can pass any fetch-compatible implementation (native fetch, node-fetch, undici, SvelteKit, Next.js, Nuxt, or a polyfill) via the fetchHandler option. This makes ffetch fully compatible with SSR, edge, metaframework environments, custom backends, and test runners.
Solution: Install a polyfill for AbortSignal.any
npm install abort-controller-x
<script type="module">
import { createClient } from 'https://unpkg.com/@fetchkit/ffetch/dist/index.min.js'
const api = createClient({ timeout: 5000 })
const data = await api('/api/data').then((r) => r.json())
</script>
plugins: [dedupePlugin()].dedupeRequestHash, which handles common body types and skips deduplication for streams and FormData.dedupePlugin({ ttl, sweepInterval }) enables map-entry eviction. TTL eviction only removes dedupe keys; it does not reject already in-flight promises.ReadableStream, FormData): Deduplication is skipped for requests with these body types, as they cannot be reliably hashed or replayed.See deduplication.md for full details.
ffetch| Feature | Native Fetch | Axios | ffetch |
|---|---|---|---|
| Timeouts | ❌ Manual AbortController | ✅ Built-in | ✅ Built-in with fallbacks |
| Retries | ❌ Manual implementation | ❌ Manual or plugins | ✅ Smart exponential backoff |
| Plugin Architecture | ❌ Not available | ⚠️ Interceptors only | ✅ First-class plugin pipeline (optional built-in + custom plugins) |
| Circuit Breaker | ❌ Not available | ❌ Manual or plugins | ✅ Automatic failure protection |
| Deduplication | ❌ Not available | ❌ Not available | ✅ Automatic deduplication of in-flight identical requests |
| Request Monitoring | ❌ Manual tracking | ❌ Manual tracking | ✅ Built-in pending requests |
| Error Types | ❌ Generic errors | ⚠️ HTTP errors only | ✅ Specific error classes |
| TypeScript | ⚠️ Basic types | ⚠️ Basic types | ✅ Full type safety |
| Hooks/Middleware | ❌ Not available | ✅ Interceptors | ✅ Comprehensive lifecycle hooks |
| Bundle Size | ✅ Native (0kb) | ❌ ~13kb minified | ✅ ~3kb minified |
| Modern APIs | ✅ Web standards | ❌ XMLHttpRequest | ✅ Fetch + modern features |
| Custom Fetch Support | ❌ No (global only) | ❌ No | ✅ Yes (wrap any fetch-compatible implementation, including framework or custom fetch) |
Got questions, want to discuss features, or share examples? Join the Fetch-Kit Discord server:
./docs/ - PRs welcome!MIT © 2025 gkoos
FAQs
Fetch wrapper with configurable timeouts, retries, and TypeScript-first DX
We found that @fetchkit/ffetch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.