
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@google/genai
Advanced tools
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/genai)
Documentation: https://googleapis.github.io/js-genai/
The Google Gen AI JavaScript SDK is designed for TypeScript and JavaScript developers to build applications powered by Gemini. The SDK supports both the Gemini Developer API and Vertex AI.
The Google Gen AI SDK is designed to work with Gemini 2.0 features.
[!NOTE] SDK Preview: See: Preview Launch.
[!CAUTION] API Key Security: Avoid exposing API keys in client-side code. Use server-side implementations in production environments.
To install the SDK, run the following command:
npm install @google/genai
The simplest way to get started is to using an API key from Google AI Studio:
import {GoogleGenAI} from '@google/genai';
const GEMINI_API_KEY = process.env.GEMINI_API_KEY;
const ai = new GoogleGenAI({apiKey: GEMINI_API_KEY});
async function main() {
const response = await ai.models.generateContent({
model: 'gemini-2.0-flash-001',
contents: 'Why is the sky blue?',
});
console.log(response.text);
}
main();
The Google Gen AI SDK provides support for both the Google AI Studio and Vertex AI implementations of the Gemini API.
For server-side applications, initialize using an API key, which can be acquired from Google AI Studio:
import { GoogleGenAI } from '@google/genai';
const ai = new GoogleGenAI({apiKey: 'GEMINI_API_KEY'});
[!CAUTION] API Key Security: Avoid exposing API keys in client-side code. Use server-side implementations in production environments.
In the browser the initialization code is identical:
import { GoogleGenAI } from '@google/genai';
const ai = new GoogleGenAI({apiKey: 'GEMINI_API_KEY'});
Sample code for VertexAI initialization:
import { GoogleGenAI } from '@google/genai';
const ai = new GoogleGenAI({
vertexai: true,
project: 'your_project',
location: 'your_location',
});
All API features are accessed through an instance of the GoogleGenAI
classes.
The submodules bundle together related API methods:
ai.models
:
Use models
to query models (generateContent
, generateImages
, ...), or
examine their metadata.ai.caches
:
Create and manage caches
to reduce costs when repeatedly using the same
large prompt prefix.ai.chats
:
Create local stateful chat
objects to simplify multi turn interactions.ai.files
:
Upload files
to the API and reference them in your prompts.
This reduces bandwidth if you use a file many times, and handles files too
large to fit inline with your prompt.ai.live
:
Start a live
session for real time interaction, allows text + audio + video
input, and text or audio output.More samples can be found in the github samples directory.
For quicker, more responsive API interactions use the generateContentStream
method which yields chunks as they're generated:
import {GoogleGenAI} from '@google/genai';
const GEMINI_API_KEY = process.env.GEMINI_API_KEY;
const ai = new GoogleGenAI({apiKey: GEMINI_API_KEY});
async function main() {
const response = await ai.models.generateContentStream({
model: 'gemini-2.0-flash-001',
contents: 'Write a 100-word poem.',
});
for await (const chunk of response) {
console.log(chunk.text);
}
}
main();
To let Gemini to interact with external systems, you can provide provide
functionDeclaration
objects as tools
. To use these tools it's a 4 step
generateContent
with function calling enabledFunctionCall
parameters to call your actual functionai.chat
)
as a FunctionResponse
import {GoogleGenAI, FunctionCallingConfigMode, FunctionDeclaration, Type} from '@google/genai';
const GEMINI_API_KEY = process.env.GEMINI_API_KEY;
async function main() {
const controlLightDeclaration: FunctionDeclaration = {
name: 'controlLight',
parameters: {
type: Type.OBJECT,
description: 'Set the brightness and color temperature of a room light.',
properties: {
brightness: {
type: Type.NUMBER,
description:
'Light level from 0 to 100. Zero is off and 100 is full brightness.',
},
colorTemperature: {
type: Type.STRING,
description:
'Color temperature of the light fixture which can be `daylight`, `cool`, or `warm`.',
},
},
required: ['brightness', 'colorTemperature'],
},
};
const ai = new GoogleGenAI({apiKey: GEMINI_API_KEY});
const response = await ai.models.generateContent({
model: 'gemini-2.0-flash-001',
contents: 'Dim the lights so the room feels cozy and warm.',
config: {
toolConfig: {
functionCallingConfig: {
// Force it to call any function
mode: FunctionCallingConfigMode.ANY,
allowedFunctionNames: ['controlLight'],
}
},
tools: [{functionDeclarations: [controlLightDeclaration]}]
}
});
console.log(response.functionCalls);
}
main();
The SDK is curently in a preview launch stage, per Google's launch stages this means:
At Preview, products or features are ready for testing by customers. Preview offerings are often publicly announced, but are not necessarily feature-complete, and no SLAs or technical support commitments are provided for these. Unless stated otherwise by Google, Preview offerings are intended for use in test environments only. The average Preview stage lasts about six months.
This SDK (@google/genai
) is Google Deepmind’s "vanilla" SDK for its generative AI offerings, and is where Google Deepmind adds new AI features.
Models hosted either on the Vertex AI platform or the Gemini Developer platform are accessible through this SDK.
Other SDKs may be offering additional AI frameworks on top of this SDK, or may be targeting specific project environments (like Firebase).
The @google/generative_language
and @google-cloud/vertexai
SDKs are previous iterations of this SDK and are no longer receiving new Gemini 2.0+ features.
0.9.0 (2025-04-17)
FAQs
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/genai)
The npm package @google/genai receives a total of 722,266 weekly downloads. As such, @google/genai popularity was classified as popular.
We found that @google/genai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.