
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@hostsmith/sdk
Advanced tools
Node.js SDK for the Hostsmith Public API. Manage sites and deploy files programmatically.
npm install @hostsmith/sdk
Requires Node.js 20 or later.
import { Hostsmith } from "@hostsmith/sdk";
const client = new Hostsmith({
accessToken: "your-oauth-access-token",
partition: "us", // "us" (United States) or "eu" (European Union)
});
// List all sites
const { sites } = await client.sites.list();
// Deploy a directory
await client.sites.deploy(sites[0].id, "./dist");
The SDK requires an OAuth 2.0 access token. See the authentication guide for how to obtain one.
const client = new Hostsmith({
accessToken: "your-access-token",
});
// List all sites
const { sites } = await client.sites.list();
// Get a site by ID
const site = await client.sites.get("site-id");
// Create a site
const { siteId } = await client.sites.create({
subdomain: "my-portfolio",
domain: "us.hostsmith.link",
});
// Delete a site
await client.sites.delete("site-id");
// List all domains (shared + custom)
const { domains } = await client.domains.list();
// List only shared hosting domains
const { domains: shared } = await client.domains.list({ shared: true });
// List only custom domains owned by your organization
const { domains: custom } = await client.domains.list({ shared: false });
// Each domain includes:
// - id, name, shared, partition, enableApexDomain, enableSubdomains, status
// - canonicalServedUrl: the URL where the site is actually served
// (https://www.<apex> for apex-enabled domains, otherwise https://<name>)
// - bareApexCovered: whether the bare apex form (https://example.com) is reachable
Deploy an entire directory:
const result = await client.sites.deploy("site-id", "./dist");
// { versionId: "...", status: "processing" }
Or deploy specific files:
import { Buffer } from "node:buffer";
const result = await client.sites.deploy("site-id", [
{ fileName: "index.html", content: Buffer.from("<h1>Hello</h1>") },
{ fileName: "style.css", content: Buffer.from("body { margin: 0 }") },
]);
The deploy method handles the full upload flow: requesting presigned URLs, uploading file parts to S3 (with concurrency), and finalizing the deployment.
Files larger than 5 MB are automatically split into multipart uploads.
Each Hostsmith data partition has its own API host. Pass partition to pick one:
| Partition | Label | Base URL |
|---|---|---|
us | United States | https://us.api.hostsmith.net |
eu | European Union | https://eu.api.hostsmith.net |
A discovery endpoint (GET /v1/partitions) returns the live list with labels.
If partition is omitted, the SDK reads the access token's homePartition claim and uses it as the default. To call a partition other than the user's home partition, pass partition explicitly.
// Default to the user's home partition (from the token's `homePartition` claim).
const home = new Hostsmith({ accessToken: token });
// One token authorized for both partitions: target a specific one.
const us = new Hostsmith({ accessToken: token, partition: "us" });
const eu = new Hostsmith({ accessToken: token, partition: "eu" });
Override the default URL map (e.g. to point at hostsmith-dev.com):
const client = new Hostsmith({
accessToken: "your-token",
partition: "us",
partitionUrls: {
us: "https://us.api.hostsmith-dev.com",
eu: "https://eu.api.hostsmith-dev.com",
},
});
Token-based defaulting also uses the overridden URLs.
For local development:
const client = new Hostsmith({
accessToken: "your-token",
baseUrl: "http://localhost:3000",
});
The SDK throws typed errors for API failures:
import { ApiError, AuthError } from "@hostsmith/sdk";
try {
await client.sites.get("nonexistent-id");
} catch (err) {
if (err instanceof AuthError) {
// 401 - token expired or invalid
console.error("Auth failed:", err.message);
} else if (err instanceof ApiError) {
// Other API errors (403, 404, 409, 429)
console.error(`API error ${err.status}:`, err.errorCode, err.message);
}
}
HostsmithError - base class for all SDK errorsApiError - API returned an error response (has status, errorCode, message)AuthError - 401 Unauthorized (extends ApiError)See CONTRIBUTING.md. For security issues, see SECURITY.md.
MIT
FAQs
Node.js SDK for the Hostsmith Public API
The npm package @hostsmith/sdk receives a total of 14 weekly downloads. As such, @hostsmith/sdk popularity was classified as not popular.
We found that @hostsmith/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.