
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@commonninja/node-sdk
Advanced tools
// NPM
npm i @commonninja/node-sdk
// Yarn
yarn add @commonninja/node-sdk
import { CommonNinja } from '@commonninja/node-sdk';
const client = new CommonNinja({
appId: process.env.COMMONNINJA_APP_ID,
appSecret: process.env.COMMONNINJA_APP_SECRET,
accessToken: req.query.token,
env: CommonNinja.envs.production,
});
// Get shop products, filter by category
const { data, success, message } = await client.ecommerce.getProducts({
category: '1',
});
// Get shop orders
const { data, success, message } = await client.ecommerce.getOrders();
// Get shop customers with pagination parameters
const { data, success, message } = await client.ecommerce.getCustomers({
limit: 5,
page: 1,
});
// Get user details
const { data, success, message } = await client.user.getDetails();
// Get connect to platform screen url
const connectUrl = client.auth.getConnectUrl();
// Get Shopify authentication url
const redirectUrl = client.auth.getAuthenticationUrl('shopify');
// Validate an incoming webhook message from Common Ninja
client.webhooks.validateWebhook(req);
Learn more about the different APIs in our official docs.
FAQs
Common Ninja SDK for NodeJS
The npm package @commonninja/node-sdk receives a total of 1 weekly downloads. As such, @commonninja/node-sdk popularity was classified as not popular.
We found that @commonninja/node-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.