
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
@automattic/api-core
Advanced tools
The API core definition for the Automattic ecosystem.
This package is the bridge between consumers and the REST APIs used throughout Automattic products, providing its data fetching functions, as well as their arguments and return types. It exists as a way to centralize data fetching logic and type definitions, and to avoid duplicating code across clients.
Each resource is mapped to a folder, and each folder follows the following structure:
src/
- <resource-name>/
- fetchers.ts
- mutators.ts
- types.ts
- index.ts
Each resource folder contains:
fetchers.ts: Functions that fetch data from the WordPress.com REST API.mutators.ts: Functions that modify data via the WordPress.com REST API.types.ts: Type definitions for the resource.index.ts: A barrel file to better control what entities get exported. This is to avoid having to import from multiple files.Simply import the desired resource function or type from the package. Example:
import { fetchDomainSuggestions, type DomainSuggestion } from '@automattic/api-core';
Then call it with the appropriate arguments. Example:
const domainSuggestions = await fetchDomainSuggestions( 'example search' );
Alternatively, you can use the useQuery hook from @tanstack/react-query to fetch the data. Example:
function MyComponent() {
const { data: domainSuggestions } = useQuery( {
queryKey: [ 'domain-suggestions', query ],
queryFn: () => fetchDomainSuggestions( query ),
} );
return null;
}
These guidelines should be followed to ensure consistency across the package.
src directory and follow the structure described above. Don't forget to add the resource barrel file to the src/index.ts file./sites/${ siteId }/domains would go in a directory called site-domains./sites/${ siteId }/domains and /sites/${ siteId }/domains/primary could belong in the same site-domains directory./devices/* are currently placed in a directory called notification-devices because otherwise it's not clear that they are related to notifications.fetchers.ts.mutators.ts.Promise.fetch prefix for fetcher function names.create, update, delete, add, remove, etc. for mutator function name prefixes.Promise):
{ success: true } (when the endpoint succeeds), the function can simply return void.{ "data": <actual data> }, we can return just the inner object.types.ts.T[] over Array< T >.FAQs
Data layer for the Automattic ecosystem.
We found that @automattic/api-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 52 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.