npmpackage.info

Gathering detailed insights and metrics for send

Other packages similar to send

@types/send

0.17.5

TypeScript definitions for send

koa-send

5.0.1

Transfer static files

@types/koa-send

4.1.6

TypeScript definitions for koa-send

sendmessage

3.0.1

Send a cross process message if message channel is connected.

Gathering detailed insights and metrics for send

send - 1.2.0 | npmpackage.info

send

Streaming static file server with Range and conditional-GET support

1.2.0

807

MIT

JavaScript

45.82 kB

6.9

Installations

npm install send

Developer Guide

BETA

Typescript

No

Module System

N/A

Min. Node Version

>= 18

Node Version

22.10.0

NPM Version

10.9.0 Pull Requests

Open

12

Total

127

Closed

79

Merged

36

Issues

Open

9

Total

95

Closed

86

Releases

1.2.0

Updated on Mar 27, 2025

1.1.0

Updated on Sep 10, 2024

0.19.0

Updated on Sep 10, 2024

View All 3 releases

Languages

JavaScript

JavaScript (100%)

Developer

pillarjs

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

807 Stars

588 Commits

194 Forks

21 Watchers

11 Branches

49 Contributors

Updated on Jun 30, 2025

Maintainers

View All 49 Contributors

Package Meta Information

Latest Version

1.2.0

Package Id

send@1.2.0

Unpacked Size

45.82 kB

Size

14.32 kB

File Count

NPM Version

10.9.0

Node Version

22.10.0

Published on

Mar 27, 2025

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

send

Send is a library for streaming files from the file system as a http response supporting partial responses (Ranges), conditional-GET negotiation (If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since), high test coverage, and granular events which may be leveraged to take appropriate actions in your application or framework.

Looking to serve up entire folders mapped to URLs? Try serve-static.

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

1$ npm install send

API

1var send = require('send')

send(req, path, [options])

Create a new SendStream for the given path to send to a res. The req is the Node.js HTTP request and the path is a urlencoded path to send (urlencoded, not the actual file-system path).

Options

acceptRanges

Enable or disable accepting ranged requests, defaults to true. Disabling this will not send Accept-Ranges and ignore the contents of the Range request header.

cacheControl

Enable or disable setting Cache-Control response header, defaults to true. Disabling this will ignore the immutable and maxAge options.

dotfiles

Set how "dotfiles" are treated when encountered. A dotfile is a file or directory that begins with a dot ("."). Note this check is done on the path itself without checking if the path actually exists on the disk. If root is specified, only the dotfiles above the root are checked (i.e. the root itself can be within a dotfile when set to "deny").

'allow' No special treatment for dotfiles.
'deny' Send a 403 for any request for a dotfile.
'ignore' Pretend like the dotfile does not exist and 404.

The default value is similar to 'ignore', with the exception that this default will not ignore the files within a directory that begins with a dot, for backward-compatibility.

end

Byte offset at which the stream ends, defaults to the length of the file minus 1. The end is inclusive in the stream, meaning end: 3 will include the 4th byte in the stream.

etag

Enable or disable etag generation, defaults to true.

extensions

If a given file doesn't exist, try appending one of the given extensions, in the given order. By default, this is disabled (set to false). An example value that will serve extension-less HTML files: ['html', 'htm']. This is skipped if the requested file already has an extension.

immutable

Enable or disable the immutable directive in the Cache-Control response header, defaults to false. If set to true, the maxAge option should also be specified to enable caching. The immutable directive will prevent supported clients from making conditional requests during the life of the maxAge option to check if the file has changed.

index

By default send supports "index.html" files, to disable this set false or to supply a new index pass a string or an array in preferred order.

lastModified

Enable or disable Last-Modified header, defaults to true. Uses the file system's last modified value.

maxAge

Provide a max-age in milliseconds for http caching, defaults to 0. This can also be a string accepted by the ms module.

root

Serve files relative to path.

start

Byte offset at which the stream starts, defaults to 0. The start is inclusive, meaning start: 2 will include the 3rd byte in the stream.

Events

The SendStream is an event emitter and will emit the following events:

error an error occurred (err)
directory a directory was requested (res, path)
file a file was requested (path, stat)
headers the headers are about to be set on a file (res, path, stat)
stream file streaming has started (stream)
end streaming has completed

.pipe

The pipe method is used to pipe the response into the Node.js HTTP response object, typically send(req, path, options).pipe(res).

Error-handling

By default when no error listeners are present an automatic response will be made, otherwise you have full control over the response, aka you may show a 5xx page etc.

Caching

It does not perform internal caching, you should use a reverse proxy cache such as Varnish for this, or those fancy things called CDNs. If your application is small enough that it would benefit from single-node memory caching, it's small enough that it does not need caching at all ;).

Debugging

To enable debug() instrumentation output export DEBUG:

$ DEBUG=send node app

Running tests

$ npm install
$ npm test

Examples

Serve a specific file

This simple example will send a specific file to all requests.

1var http = require('http')
2var send = require('send')
3
4var server = http.createServer(function onRequest (req, res) {
5  send(req, '/path/to/index.html')
6    .pipe(res)
7})
8
9server.listen(3000)

Serve all files from a directory

This simple example will just serve up all the files in a given directory as the top-level. For example, a request GET /foo.txt will send back /www/public/foo.txt.

1var http = require('http')
2var parseUrl = require('parseurl')
3var send = require('send')
4
5var server = http.createServer(function onRequest (req, res) {
6  send(req, parseUrl(req).pathname, { root: '/www/public' })
7    .pipe(res)
8})
9
10server.listen(3000)

Custom file types

1var extname = require('path').extname
2var http = require('http')
3var parseUrl = require('parseurl')
4var send = require('send')
5
6var server = http.createServer(function onRequest (req, res) {
7  send(req, parseUrl(req).pathname, { root: '/www/public' })
8    .on('headers', function (res, path) {
9      switch (extname(path)) {
10        case '.x-mt':
11        case '.x-mtt':
12          // custom type for these extensions
13          res.setHeader('Content-Type', 'application/x-my-type')
14          break
15      }
16    })
17    .pipe(res)
18})
19
20server.listen(3000)

Custom directory index view

This is an example of serving up a structure of directories with a custom function to render a listing of a directory.

1var http = require('http')
2var fs = require('fs')
3var parseUrl = require('parseurl')
4var send = require('send')
5
6// Transfer arbitrary files from within /www/example.com/public/*
7// with a custom handler for directory listing
8var server = http.createServer(function onRequest (req, res) {
9  send(req, parseUrl(req).pathname, { index: false, root: '/www/public' })
10    .once('directory', directory)
11    .pipe(res)
12})
13
14server.listen(3000)
15
16// Custom directory handler
17function directory (res, path) {
18  var stream = this
19
20  // redirect to trailing slash for consistent url
21  if (!stream.hasTrailingSlash()) {
22    return stream.redirect(path)
23  }
24
25  // get directory list
26  fs.readdir(path, function onReaddir (err, list) {
27    if (err) return stream.error(err)
28
29    // render an index for the directory
30    res.setHeader('Content-Type', 'text/plain; charset=UTF-8')
31    res.end(list.join('\n') + '\n')
32  })
33}

Serving from a root directory with custom error-handling

1var http = require('http')
2var parseUrl = require('parseurl')
3var send = require('send')
4
5var server = http.createServer(function onRequest (req, res) {
6  // your custom error-handling logic:
7  function error (err) {
8    res.statusCode = err.status || 500
9    res.end(err.message)
10  }
11
12  // your custom headers
13  function headers (res, path, stat) {
14    // serve all files for download
15    res.setHeader('Content-Disposition', 'attachment')
16  }
17
18  // your custom directory handling logic:
19  function redirect () {
20    res.statusCode = 301
21    res.setHeader('Location', req.url + '/')
22    res.end('Redirecting to ' + req.url + '/')
23  }
24
25  // transfer arbitrary files from within
26  // /www/example.com/public/*
27  send(req, parseUrl(req).pathname, { root: '/www/public' })
28    .on('error', error)
29    .on('directory', redirect)
30    .on('headers', headers)
31    .pipe(res)
32})
33
34server.listen(3000)

License

MIT

Moderate

5.3/10

Summary

Root Path Disclosure in send

Affected Versions

< 0.11.1

Patched Versions

0.11.1

Moderate

0/10

Summary

Moderate severity vulnerability that affects send

Affected Versions

< 0.8.4

Patched Versions

0.8.4

Low

5/10

Summary

send vulnerable to template injection that can lead to XSS

Affected Versions

< 0.19.0

Patched Versions

0.19.0

Low

0/10

Summary

Directory Traversal in send

Affected Versions

< 0.8.4

Patched Versions

0.8.4

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

CI-Tests

Determines if the project runs tests before pull requests are merged.

10

Contributors

Determines if the project has a set of contributors from multiple organizations (e.g., companies).

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Dependency-Update-Tool

Determines if the project uses a dependency update tool.

10

License

Determines if the project has defined a license.

10

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

9

Security-Policy

Determines if the project has published a security policy.

7

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

7

SAST

Determines if the project uses static code analysis.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

2

Maintained

Determines if the project is "actively maintained".

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

Reason

project is not fuzzed

Details

Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)

Score

6.9

/10

Last Scanned on 2025-07-07T21:29:07Z

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to send

Other packages similar to send

send

Installations

Developer Guide

No

N/A

>= 18

22.10.0

10.9.0

Pull Requests

12

127

79

36

Issues

9

95

86

Releases

Languages

Developer

pillarjs

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

Dev Dependencies

send

Installation

API

send(req, path, [options])

Options

acceptRanges

cacheControl

dotfiles

end

etag

extensions

immutable

index

lastModified

maxAge

root

start

Events

.pipe

Error-handling

Caching

Debugging

Running tests

Examples

Serve a specific file

Serve all files from a directory

Custom file types

Custom directory index view

Serving from a root directory with custom error-handling

License

10

10

10

10

10

10

10

10

9

7

7

3

2

0

0

0