
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@fedyacpp/bs-api-js
Advanced tools
A fully typed JavaScript/TypeScript client for the official Brawl Stars API.
A fully typed JavaScript/TypeScript client for the official Brawl Stars API, designed for Node.js environments.
npm install @fedyacpp/bs-api-js
# or
yarn add @fedyacpp/bs-api-js
You must obtain an API key (JWT) from the Brawl Stars Developer Portal.
The recommended way to provide the API key to the client is through an environment variable named BRAWL_STARS_API_KEY.
Example (PowerShell):
$env:BRAWL_STARS_API_KEY = 'YOUR_API_KEY'
Example (Bash/Zsh):
export BRAWL_STARS_API_KEY='YOUR_API_KEY'
Replace YOUR_API_KEY with your actual key.
You can also pass the key directly to the constructor, but who really does this?
import { BrawlStarsClient, BrawlStarsApiError, Player } from '@fedyacpp/bs-api-js';
// Retrieve the API key from environment variables
const apiKey = process.env.BRAWL_STARS_API_KEY;
if (!apiKey) {
console.error('Error: BRAWL_STARS_API_KEY environment variable not set.');
process.exit(1);
}
// Initialize the client
const client = new BrawlStarsClient(apiKey);
// Example: Fetch player data
async function getPlayerData(playerTag: string) {
try {
console.log(`Fetching player data for tag: ${playerTag}...`);
const player: Player = await client.getPlayer(playerTag);
console.log(`\nPlayer Name: ${player.name}`);
console.log(`Trophies: ${player.trophies}`);
console.log(`Highest Trophies: ${player.highestTrophies}`);
const clubName = (player.club && typeof player.club === 'object' && 'name' in player.club) ? player.club.name : 'N/A';
console.log(`Club: ${clubName}`);
if (player.brawlers.length > 0) {
console.log(`\nTop Brawler: ID ${player.brawlers[0].id} (Trophies: ${player.brawlers[0].trophies})`);
}
} catch (error) {
if (error instanceof BrawlStarsApiError) {
console.error(`API Error (${error.statusCode || 'N/A' }): ${error.message}`);
if (error.errorData) {
console.error(`Reason: ${error.errorData.reason}`);
}
} else {
console.error('An unexpected error occurred:', error);
}
}
}
// Example usage
const examplePlayerTag = '#PLAYER_TAG'; // TODO: Replace with a real tag
if (examplePlayerTag !== '#PLAYER_TAG') {
getPlayerData(examplePlayerTag);
} else {
console.warn("Please replace '#PLAYER_TAG' in the example code with a valid player tag.");
}
The client instance provides the following methods, corresponding to the API endpoints:
getPlayer(playerTag: string): Promise<Player>getPlayerBattleLog(playerTag: string): Promise<BattleList>getClub(clubTag: string): Promise<Club>getClubMembers(clubTag: string, options?: PagingOptions): Promise<ClubMemberList>getBrawlers(options?: PagingOptions): Promise<BrawlerList>getBrawler(brawlerId: number | string): Promise<BrawlerDefinition>getPlayerRankings(countryCode: string, options?: PagingOptions): Promise<PlayerRankingList>getClubRankings(countryCode: string, options?: PagingOptions): Promise<ClubRankingList>getBrawlerRankings(countryCode: string, brawlerId: number | string, options?: PagingOptions): Promise<PlayerRankingList>getEventRotation(): Promise<ScheduledEvents>Where PagingOptions is an object: { limit?: number; after?: string; before?: string }.
All methods return Promises that resolve with the corresponding typed data (see src/types.ts) or reject with a BrawlStarsApiError.
API errors are thrown as BrawlStarsApiError instances, extending the built-in Error class. They contain:
message: The error message from the API or the request.statusCode: The HTTP status code (e.g., 403, 404, 429).errorData: The original JSON error object returned by the API (if available), containing reason, message, type, etc.import { BrawlStarsApiError } from '@fedyacpp/bs-api-js';
try {
const data = await client.getPlayer('#INVALID-TAG');
// ... process data
} catch (error) {
if (error instanceof BrawlStarsApiError) {
console.error(`API Error: ${error.message}`);
console.error(`Status Code: ${error.statusCode}`);
if (error.errorData) {
console.error(`API Reason: ${error.errorData.reason}`);
console.error('Full Error Data:', error.errorData);
}
} else {
// Handle other unexpected errors (network issues, etc.)
console.error('Unknown error:', error);
}
}
This package includes an interactive command-line tool to easily test all client functions directly against the API.
Requirements:
BRAWL_STARS_API_KEY environment variable must be set (see Configuration).Running the CLI:
npm installnpm run test:cliThe script will build the project if necessary and then launch an interactive prompt (using inquirer) asking which API function you want to test. Follow the prompts to enter required tags, IDs, country codes, or paging options.
/src: Contains the TypeScript source code.
client.ts: The main BrawlStarsClient class implementation.types.ts: TypeScript interfaces for all API data models and responses.index.ts: Entry point, exports the client and types.test-cli.ts: The source code for the interactive test CLI./dist: Contains the compiled JavaScript code and declaration files (.d.ts), generated by running npm run build. This is what gets published and used when the package is imported.package.json: NPM package configuration, scripts, and dependencies.tsconfig.json: TypeScript compiler configuration.definition.txt: The original API definition provided (for reference).To compile the TypeScript code to JavaScript in the dist directory, run:
npm run build
Contributions, issues, and feature requests are welcome! Please feel free to open an issue or submit a pull request.
MIT
FAQs
A fully typed JavaScript/TypeScript client for the official Brawl Stars API.
We found that @fedyacpp/bs-api-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.