
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
@google/genai
Advanced tools
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/genai)
Documentation: https://googleapis.github.io/js-genai/
The Google Gen AI JavaScript SDK is an experimental SDK designed for TypeScript and JavaScript developers to build applications powered by Gemini. The SDK supports both the Gemini Developer API and Vertex AI.
The Google Gen AI SDK is designed to work with Gemini 2.0 features.
[!CAUTION] Experimental SDK: This SDK is under active development and may experience breaking changes.
[!CAUTION] API Key Security: Avoid exposing API keys in client-side code. Use server-side implementations in production environments.
pnpm or npmTo install the SDK, run the following command:
npm install @google/genai
The simplest way to get started is to using an API key from Google AI Studio:
import {GoogleGenAI} from '@google/genai';
const GEMINI_API_KEY = process.env.GEMINI_API_KEY;
const ai = new GoogleGenAI({apiKey: GEMINI_API_KEY});
async function main() {
const response = await ai.models.generateContent({
model: 'gemini-2.0-flash-001',
contents: 'Why is the sky blue?',
});
console.log(response.text);
}
main();
The package contents are also available unzipped in the
package/ directory of the bucket, so an equivalent web example is:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Using My Package</title>
</head>
<body>
<script type="module">
import {GoogleGenAI, Type} from 'dist/web/index.mjs';
const ai = new GoogleGenAI({apiKey:"YOUR_API_KEY"});
async function main() {
const response = await ai.models.generateContent({
model: 'gemini-2.0-flash-001',
contents: 'Why is the sky blue?',
});
console.log(response.text());
}
main();
</script>
</body>
</html>
The Google Gen AI SDK provides support for both the Google AI Studio and Vertex AI implementations of the Gemini API.
For server-side applications, initialize using an API key, which can be acquired from Google AI Studio:
import { GoogleGenAI } from '@google/genai';
const ai = new GoogleGenAI({apiKey: 'GEMINI_API_KEY'});
[!CAUTION] API Key Security: Avoid exposing API keys in client-side code. Use server-side implementations in production environments.
In the browser the initialization code is identical:
import { GoogleGenAI } from '@google/genai';
const ai = new GoogleGenAI({apiKey: 'GEMINI_API_KEY'});
Sample code for VertexAI initialization:
import { GoogleGenAI } from '@google/genai';
const ai = new GoogleGenAI({
vertexai: true,
project: 'your_project',
location: 'your_location',
});
All API features are accessed through an instance of the GoogleGenAI classes.
The submodules bundle together related API methods:
client.models:
Use models to query models (generateContent, generateImages, ...), or
examine their metadata.client.caches:
Create and manage caches to reduce costs when repeatedly using the same
large prompt prefix.client.chats:
Create local stateful chat objects to simplify multi turn interactions.client.files:
Upload files to the API and reference them in your prompts.
This reduces bandwidth if you use a file many times, and handles files too
large to fit inline with your prompt.client.live:
Start a live session for real time interaction, allows text + audio + video
input, and text or audio output.More samples can be found in the github samples directory.
For quicker, more responsive API interactions use the generateContentStream
method which yields chunks as they're generated:
import {GoogleGenAI} from '@google/genai';
const GEMINI_API_KEY = process.env.GEMINI_API_KEY;
const ai = new GoogleGenAI({apiKey: GEMINI_API_KEY});
async function main() {
const response = await ai.models.generateContentStream({
model: 'gemini-2.0-flash-001',
contents: 'Write a 100-word poem.',
});
for await (const chunk of response) {
console.log(chunk.text);
}
}
main();
To let Gemini to interact with external systems, you can provide provide
functionDeclaration objects as tools. To use these tools it's a 4 step
generateContent with function calling enabledFunctionCall parameters to call your actual functionai.chat)
as a FunctionResponseimport {GoogleGenAI, FunctionCallingConfigMode, FunctionDeclaration, Type} from '@google/genai';
const GEMINI_API_KEY = process.env.GEMINI_API_KEY;
async function main() {
const controlLightDeclaration: FunctionDeclaration = {
name: 'controlLight',
parameters: {
type: Type.OBJECT,
description: 'Set the brightness and color temperature of a room light.',
properties: {
brightness: {
type: Type.NUMBER,
description:
'Light level from 0 to 100. Zero is off and 100 is full brightness.',
},
colorTemperature: {
type: Type.STRING,
description:
'Color temperature of the light fixture which can be `daylight`, `cool`, or `warm`.',
},
},
required: ['brightness', 'colorTemperature'],
},
};
const ai = new GoogleGenAI({apiKey: GEMINI_API_KEY});
const response = await ai.models.generateContent({
model: 'gemini-2.0-flash-001',
contents: 'Dim the lights so the room feels cozy and warm.',
config: {
toolConfig: {
functionCallingConfig: {
// Force it to call any function
mode: FunctionCallingConfigMode.ANY,
allowedFunctionNames: ['controlLight'],
}
},
tools: [{functionDeclarations: [controlLightDeclaration]}]
}
});
console.log(response.functionCalls);
}
main();
FAQs
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/genai)
The npm package @google/genai receives a total of 7,694,658 weekly downloads. As such, @google/genai popularity was classified as popular.
We found that @google/genai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.