Hey,
State is held on the file level in this module. This is not a good strategy because it prevents using the module twice for different routes. It will also break should another piece of code in the app or in any of its dependencies also use this module. Under various circumstances two calls to require("connect-ratelimit") may end up with the same instance.
Cheers