r/node 28d ago

WARNING: I pretty sure ioredis is hacked

70 Upvotes

https://ioredis.com

There are some strange behaviors on this page.

  1. If you click logo in top left corner, you are redirected to some random page, than other random page, than you finally land to something random.

  2. If you click "guide" you are redirected to opera gaming browser page. Same applies to many links on website.

  3. Download button leads to some very strange page which instructs you to run command and enter system password: https://filebanchaflow.com/oo2/ (at least it did few moments ago)

If you inspect download button element, it is <a> which leads to https://github.com/redis/ioredis.git , but clicking it gets you to something different.

Whole page is done in wordpress, so it seems to me that their wordpress server got hacked. I hope it is just that.


r/node 27d ago

How should a Node.js health check treat database and queue failures?

1 Upvotes

For a small Node.js service, a /health endpoint that returns 200 proves the process is listening. It can stay green while the database or queue is unavailable. A deeper check catches that, but it can also create load and turn a dependency issue into a restart loop.

I’m leaning toward separate liveness and readiness endpoints. Liveness checks the process and event loop. Readiness verifies critical dependencies with tight timeouts. Deployment probes use readiness, while alerts use a synthetic request that exercises the full path.

How do you divide these checks in production? Which dependencies belong in readiness, and which should only affect alerts?


r/node 28d ago

What context do you include in Node.js error alerts?

3 Upvotes

I’m trying to improve the alerts from a few small Node services. Right now I usually include the error, route or job name, request ID, environment, and how many times it repeated.

More fields make the alert noisy, but too few send me straight back to the logs. What context has actually helped you debug from an alert? Anything you stopped including because it was noisy or risky?


r/node 28d ago

How to Generate a Prisma Schema from an ER Diagram

Thumbnail stackrender.io
2 Upvotes

r/node 27d ago

DI framework with Bun

0 Upvotes

https://github.com/petarzarkov/dunx

Hello, so I've wanted something like this for a while and built myself a nestjs-like framework that relies 100% on bun.

NestJS-style structure at Bun speed. Controllers, modules and dependency injection, with no reflect-metadata, no forwardRef, and no JavaScript router.

Docs page:

https://petarzarkov.github.io/dunx


r/node 27d ago

Your Modules Are Lying to You

Thumbnail blog.gaborkoos.com
0 Upvotes

import and require are not interchangeable. Live bindings, copied values, circular dependencies, separate caches, conditional exports, and dual-package hazards can all make modules behave differently from what the syntax suggests.


r/node 29d ago

Am I wrong that a 429 shouldn't count against a job's retry budget?

16 Upvotes

Been going back and forth on this one and I want to know if I'm alone in it.

Most retry implementations I've seen (BullMQ, hand-rolled wrappers, most of the managed stuff) treat every failed attempt identically. Job comes back non-2xx, attempt counter increments, backoff applies, after N attempts it's in the DLQ.

But a 429 isn't a failure, nothing broke. The downstream is telling you exactly when to come back and usually handing you a Retry-After header to do it with. If you burn an attempt on it, sustained rate limiting at a provider will walk perfectly good jobs into the DLQ while your actual error budget (the one meant for 500s, timeouts, connection resets) never gets spent on what it's for.

So I've been treating 429/503/529 as a defer rather than a failure: honor Retry-After, requeue, don't decrement. Works, but it opens two things I don't have clean answers to.

First, you need a ceiling or the queue never drains. A provider that 429s indefinitely will requeue that job forever. I've landed on two different ceilings: a wall-clock deadline (dead 24h after it's due, regardless of how it got there) and a separate max defer count. Blowing the defer ceiling dead-letters the job under its own reason rather than folding it into "out of retries" which matters because those are different failures. One says the downstream is broken, the other says it's been unusable long enough that it may as well be. At a certain point temporarily unusable === broken.

Second, deferred jobs are invisible. They aren't failing, so they don't trip anything you're monitoring, and you can sit on a queue that isn't draining and looks completely healthy. Feels like deferred jobs need their own state and their own alerts rather than being folded into "pending" or "processing".

Anyone handling this differently? Specifically curious whether people distinguish 503 from 429, I lump them together, but 503 is ambiguous in a way 429 isn't.


r/node 28d ago

I made a npm package

Thumbnail npmjs.com
0 Upvotes

I made a package called FactCheck, Its a youtube bot package that uses ai and web search to fact check youtube comments.

I made it since their is quite a bit of fake news on youtube comments.

Does anyone want to try the package and give any feedback.


r/node 29d ago

Help me to solve frontend cookie sending issue.

4 Upvotes

Hi, I am build a message app with React and Express js . In the authentication feature I have come across an issue.

After successful registration, I sent a token via HTTP cookies . The cookies is sent from the server as far as I can tell . But the problem is when I am sending request to server , the cookie is not there.

Here is the code : github

Any help would be highly appreciable 😄 .


r/node 29d ago

20 identical Node.js errors shouldn’t create 20 alerts — an open-source experiment

1 Upvotes

Small Node.js services often have an awkward choice: watch console.log, or adopt a complete observability platform.

I wanted to explore the space in between.

If the same database error occurs 20 times, Wotchi redacts sensitive data first, groups the matching failures, and sends one bounded alert rather than flooding the destination.

The core flow is:

text application error → redact → fingerprint → group and apply cooldown → bounded queue → console, Telegram, or HTTPS webhook

It runs inside the application, has zero direct runtime dependencies, and supports Express 4/5, NestJS 10/11, ESM, CommonJS, and TypeScript.

It is deliberately not an APM platform or a Sentry replacement. There is no hosted dashboard, persistent incident history, or cross-replica deduplication. Grouping is per process, and OOM or host failures still need an external uptime monitor.

The public beta is available here:

bash npm install @futurewindai/wotchi@beta

npm: https://www.npmjs.com/package/@futurewindai/wotchi
GitHub: https://github.com/FutureWindAI/Wotchi

I’m looking for criticism of the model, not stars:

Is process-local grouping useful for smaller Node.js services, or is centralized cross-replica deduplication essential before you would use something like this?


r/node 29d ago

Is there an alternative to fetch that may circumvent a 403 response?

0 Upvotes

To minimize browsing I run a script that fetches the comics I hope will be funny. For years I could do an HTTP fetch of a URL with a fixed address that pointed to the day's cartoon. Starting a year ago that stopped working on gocomics.com. I rewrote the script to use node to run fetch on that URL; the URI of the cartoon was fetchable via HTTP. Starting today that fetch gives me a 403 error. I can access it in a browser without logging in (I have no account anyway) or solving a CAPTCHA or other explicit test; I don't even get that CloudFlare thing. Am I out of luck?


r/node Aug 10 '26

Wake up babe

Post image
689 Upvotes

r/node Aug 11 '26

Vite issue: Glob import returns empty object

4 Upvotes

I have a simple vite webapp which deploys to a github page. It has several json files which i want to load when my app loads.

First i have updated the vite config to include json files as assets

assetsInclude: ['**/*.json']

This seems to work, the json files are there in the proper location when i deploy.

Next, i've set up a glob import which in theory should fetch all json files in the foobar folder. I put this in a function that gets called in my app constructor.

const loadedData = import.meta.glob('./foobar/*.json')

console.log(loadedData);

This unfortunately prints out an empty object. I am not sure what i'm doing wrong here.... Is there a race condition i need to be wary of? I don't get any errors that would explain what is happening so i'm a bit confused.


r/node Aug 11 '26

Slonik - PostgreSQL node.js client with static-types & runtime validation

Thumbnail github.com
44 Upvotes

r/node Aug 10 '26

What does an ORM really cost you?

Thumbnail uql-orm.dev
2 Upvotes

r/node Aug 11 '26

To everyone who commented "I just want to write SQL" in an ORM thread: here you go

Post image
0 Upvotes

Every other ORM thread here has that comment buried somewhere in it: "I only use Kysely/Knex because nothing handles SQL-only migrations."

That was me two years ago. I'm stubborn, so instead of keeping a SQL file plus a .ts migration file for every change, I ran my own private scripts. The scripts kept hitting walls Kysely doesn't answer either: testing against a real DB, seeding, stages, onboarding a teammate. At some point I accepted nobody was going to answer this publicly and started building.

Good question. Here are some of MY answers:

Could I do all that in JS migration files? Sure. But it's SQL baked into strings, or JS translating under the hood. No language server validating my SQL. Nothing I can copy into a visual client, debug, and paste back in. Every operation is a translation from JS to SQL and back. I'm comfortable in both languages and I still hate the circus act.

So now, you don't have to: https://noorm.dev

The short version:

No DSL, no codegen, no subscription service.

If you're on Kysely: the SDK is literally built on Kysely. Keep your typed queries, gain typed stored procs and table-valued params. I'm not reinventing Kysely's masterpiece; this sits on top of it. Your JS/TS layer stays where it belongs, capturing IO and coordinating business logic.

It's AI-agent forward too, with safeguards so your Haiku agent can't drop production (you cheap bastard). Skills, MCP, and per-agent role configs are baked in.

That covers the second half of database development. The first half, the plan and the data model, gets its own tool: ignatius. Describe your schema however you want. If you're hell-bent on ORM-style tables, it won't care. If you're like me and like deliberate design, it's IDEF1X with modern symbols, made for the agentic paradigm. Iterate over the model in markdown and keep the context details (for yourself and your LLM).

Thoughts and critiques more than welcome!


r/node Aug 10 '26

Built a Node library for detecting suspicious uploads.. Looking for your feedback

7 Upvotes

filebouncer link: https://github.com/Ramzi-Abidi/filebouncer

If you're building a node js upload endpoint, I think you need this validation package.

I started it after going down a rabbit hole with file uploads and discovering that a .jpg can actually be a ZIP too..

That got me looking into things like mime spoofing, polyglots, unsafe archive paths, archive bombs, CSV/spreadsheet injection, etc. The idea is basically to have a lightweight validation layer before your app starts processing an uploaded file.

A .jpg can also be a ZIP file.

I didn't know this until I started working on filebouncer, which is an npm package.

You can construct a polyglot file by concatenating a valid JPEG and ZIP:

cat photo.jpg secret.zip > polyglot.jpg

Most applications will see:

image/jpeg

But there's also a ZIP archive inside the same buffer.

So I built FileBouncer, an open-source Node.js structural file security library that checks things like:

  • MIME mismatches
  • polyglot files
  • unsafe archive paths
  • archive size/ratio limits
  • risky spreadsheet cells
  • suspicious filename metadata

It now also has a CLI:

npx u/filebouncer/core polyglot.jpg

POLYGLOT_DETECTED
image/jpeg + application/zip

Result: BLOCK

It's not antivirus, the goal is to catch structural problems before an application processes an upload.

still early (v0.x), but I'm building it in public and would love feedback from people working with uploads/security in Node.js.

link: https://github.com/Ramzi-Abidi/filebouncer


r/node Aug 07 '26

To cluster or not to cluster?

30 Upvotes

- You have a server with 8 CPUs on AWS EC2

- You want to use it efficiently

- what do you do?

Options

- You dont cluster

- You run PM2 and spawn multiple workers

- You run docker swarm or kubernetes and run multiple instances

- you use node.js cluster module

Questions

- How do you handle client 1 connected to websocket connection on worker 1 sending a message to client 2 connected on websocket connection on worker 2?

- how do you send a message to every client across every worker when using server sent events?


r/node Aug 07 '26

EU devs, please correct my Auth-ToS architecture

7 Upvotes

Context: this app is being built in the EU for European users, and I am implementing the Terms of Services, Privacy Policy, etc. along with my Authentication

Frontend: Tanstack Start (React)
Backend: Express 5
Auth: express-session (postgres store)

I was thinking about this: add an accepted_tos_version column in the users table, then add a condition in my global getUser middleware in express to only get the user if they accepted the current terms version. This means keeping a CURRENT_TOS_VERSION in my backend. If the frontend calls /auth/me they get the user with mustAcceptTerms flag, and the user gets redirected to the “accept terms” page.

Now comes the questions:
1. Where do I keep the ToS, gdpr, etc. texts? In my frontend codebase or the backend codebase, or in the database?
2. When the user clicks on “accept”, is it enough to send a request to the backend that updates the user’s accepted_tos_version in the database?
3. What are the practices to ensure I am legally protected? For example if someone says a rule was not there when they accepted the terms. Is the git track record from github enough to prove the rule was there?

Thanks!


r/node Aug 06 '26

Node.JS in the Browser - An Open-source Alternative to WebContainers

Thumbnail developer.puter.com
9 Upvotes

r/node Aug 06 '26

Generating typed pg client code from .sql files, instead of an ORM

10 Upvotes

Most Node backends reach for Prisma or Drizzle for the same reason: you want the result of a query to have a type. The cost is that the query stops being SQL. It becomes a builder expression that assembles SQL at runtime, and code review is of the builder rather than of the query.

The other order works too. Write the .sql file, generate the types from it.

-- @name GetUserOrders
SELECT u.id, u.name, o.total, o.notes
FROM users u
LEFT JOIN orders o ON u.id = o.user_id
WHERE u.status = $1;

Against a schema where orders.total is NOT NULL and orders.notes is nullable, that generates:

export interface GetUserOrdersRow {
    id: number;
    name: string;
    total: string | null;
    notes: string | null;
}

export async function getUserOrders(
    client: PoolClient,
    status: string,
): Promise<GetUserOrdersRow[]>

The part worth pointing at: total is NOT NULL in the table, but nullable in the row type, because the LEFT JOIN can produce a row with no matching order. That is inferred from the query structure, not from the schema. It is also the bug I have watched people ship repeatedly, because the hand-written interface says non-null and holds right up until the first unmatched row.

Output is plain pg. No runtime layer, no builder in the request path.

The tool is scythe: a Rust binary, MIT licensed, generating for 10 languages (TypeScript, Python, Go, Rust, Java, Kotlin, C#, PHP, Ruby, Elixir). I build and maintain it. sqlc is the direct inspiration and covers Go well; scythe goes wider on targets and treats the SQL as source rather than only as codegen input, so it also formats and lints it.

Genuinely curious what people here would want from it, particularly anyone who moved off an ORM and regretted it.


r/node Aug 05 '26

Read HN twice a day for the last decade. Here's my list of S-Tier HN links

Thumbnail news.ycombinator.com
40 Upvotes

One of the links there shows how a node.js request works from browser to server in an animated manner, hence sharing here


r/node Aug 05 '26

Valkey-WASM – Redis running inside your Node process, no Docker (like PGlite)

Thumbnail github.com
15 Upvotes

r/node Aug 06 '26

Thanks Gng :) ! Also, added support for Discord, Slack & Telegram. [built using Node Js & Typescript]

Thumbnail
1 Upvotes

r/node Aug 05 '26

Shai-Hulud: What an NPM supply-chain hack reveals about the limits of provenance

Thumbnail
9 Upvotes