Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@biblioteksentralen/bmd-search-client
Advanced tools
Search client for Bibliotekenes metadatabrønn
import { createCordataApiClient } from "@biblioteksentralen/bmd-search-client";
const cordata = createCordataApiClient({
clientIdentifier: "My little library app (drift@elvesund.no)",
catalogueId: "tonsberg",
});
const { data, error } = await cordata.searchWorks({
query: "jo nesbø",
});
if (error) {
console.error(error);
} else {
console.log(`Fetched ${data.results.length} results:`);
for (const result of data.results) {
console.log(`- ${result.work.title.mainTitle}`);
}
}
This package provides clients for two BMD APIs:
The Public Library API, based on the Public Library API Specification, in which the response models have been modelled to provide interoperability with other library systems with different data models. Metadata is simplified into a two-level model (Work-Publication) which is generally easier to work with, but cannot express every metadata aspect that a three-level model can provide.
import { createPublicLibraryApiClient } from "@biblioteksentralen/bmd-search-client";
const plas = createPublicLibraryApiClient({ clientIdentifier: "My little library app (drift@elvesund.no)" });
const results = await plas.searchWorks({ query: "Jo Nesbø" });
The Cordata API, which uses the same request structure, but provides responses based on our internal Cordata metadata model, a three-level model (Work-Expression-Manifestation) which can be more suited for library professionals.
import { createCordataApiClient } from "@biblioteksentralen/bmd-search-client";
const cordata = createCordataApiClient({ clientIdentifier: "My little library app (drift@elvesund.no)" });
const results = await cordata.searchWorks({ query: "Jo Nesbø" });
The two APIs are aligned as much as possible. Endpoints generally use the same request structure, but different response structure. Some APIs are only available in one or the other API, for instance the "Get Publications" endpoint is only available in the Public Library API.
The API does not require authentication, but clients should identify themselves using a descriptive
name and a contact address in the clientIdentifier
string. We will only contact you about usage of the API.
Clients are initialized with a global scope by default. Construct the client with a catalogueId
to
scope it to a specific library catalogue. Note that catalogue scoping only guarantees that results
are found in the given library catalogue, not that the library have active holdings. If the actual
holdings have been weeded, the catalogue record may still be present.
const client = createCordataApiClient({
catalogueId: "tonsberg",
...otherOptions,
});
The client connects to the production environment by default, but it can be constructed to use the staging environment instead:
const client = createCordataApiClient({
environment: "staging",
...otherOptions,
});
FAQs
Search client for Bibliotekenes metadatabrønn
We found that @biblioteksentralen/bmd-search-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.