
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@kolbo/app-sdk
Advanced tools
The official SDK for Kolbo App Builder generated apps.
Provides a unified client for auth, data, storage, and AI — all backed by the Kolbo platform.
npm install @kolbo/app-sdk
In apps generated by Kolbo App Builder, src/lib/kolbo.ts is auto-injected and pre-configured. You never need to call createClient yourself — just import:
import { kolbo } from '../lib/kolbo';
For custom apps or external projects:
import { createClient } from '@kolbo/app-sdk';
const kolbo = createClient(); // reads VITE_KOLBO_* env vars automatically
kolbo.authKolbo-native auth. Email + password, email OTP, and Google OAuth (via the
shared Kolbo proxy at auth.kolbo.ai) — all backed by Kolbo's own user
store. No separate Supabase project required.
// Email + password
await kolbo.auth.signUp({ email: 'user@example.com', password: 'secret' });
await kolbo.auth.signInWithPassword({ email: 'user@example.com', password: 'secret' });
// Email OTP (magic code)
await kolbo.auth.signInWithOtp({ email: 'user@example.com' });
await kolbo.auth.verifyOtp({ email: 'user@example.com', code: '123456' });
// Google OAuth — works identically in sandbox previews and published URLs.
// Opens a popup, uses PKCE, returns a Kolbo session.
const { data, error } = await kolbo.auth.signInWithGoogle({ redirectTo: '/auth/callback' });
// Get current user
const { data: { user } } = await kolbo.auth.getUser();
// Sign out
await kolbo.auth.signOut();
// Listen to auth state changes (same-tab + cross-tab via `storage` events)
const { data: { subscription } } = kolbo.auth.onAuthStateChange((event, session) => { ... });
// ...later
subscription.unsubscribe();
Set VITE_KOLBO_BACKEND=supabase and provide VITE_SUPABASE_URL +
VITE_SUPABASE_ANON_KEY to route auth + data through your own Supabase
project instead of Kolbo's backend. Requires @supabase/supabase-js as a
peer dependency.
kolbo.dataMongoDB-backed shared database. Scoped to your app — other apps can't read your data.
// List with filter + sort + pagination
const { data, error } = await kolbo.data.list('tasks', {
where: { userId: user.id, status: 'active' },
sort: { createdAt: -1 },
limit: 20,
offset: 0,
});
// CRUD
const { data: task } = await kolbo.data.create('tasks', { title: 'Buy milk', userId: user.id });
const { data: updated } = await kolbo.data.update('tasks', task._id, { status: 'done' });
await kolbo.data.delete('tasks', task._id);
kolbo.storage// Upload a file
const { data } = await kolbo.storage.upload('avatars', file.name, file);
const publicUrl = data.url; // permanent CDN URL
// List files
const { data: files } = await kolbo.storage.list('avatars');
// Delete
await kolbo.storage.delete('avatars', data.id);
kolbo.aiCall Kolbo's AI APIs. Polls automatically — resolves when generation is complete.
// Chat / text generation
const { content, session_id } = await kolbo.ai.chat({ message: 'Tell me a joke' });
// Continue a conversation
const { content: reply } = await kolbo.ai.chat({ message: 'Another one', session_id });
// Image generation
const { url } = await kolbo.ai.generateImage({ prompt: 'Sunset over the ocean', aspect_ratio: '16:9' });
// Video generation (takes 1–5 minutes)
const { url: videoUrl } = await kolbo.ai.generateVideo({ prompt: 'Timelapse of a busy city', duration: 5 });
// Music
const { url: musicUrl } = await kolbo.ai.generateMusic({ prompt: 'Upbeat jazz background' });
// TTS
const { url: speechUrl } = await kolbo.ai.generateSpeech({ text: 'Hello world', voice: 'shimmer' });
VITE_KOLBO_API_KEYandVITE_KOLBO_BASEare auto-injected into every Kolbo App Builder app. You never need to configure them manually.
| Variable | Required | Description |
|---|---|---|
VITE_KOLBO_APP_ID | ✅ | Your app's unique ID |
VITE_KOLBO_API_URL | ✅ | Kolbo backend URL (auth + data + storage live under /api/*) |
VITE_KOLBO_API_KEY | For kolbo.ai | Kolbo public API key |
VITE_KOLBO_BASE | For kolbo.ai | Kolbo API base URL (default: https://api.kolbo.ai/api) |
VITE_KOLBO_OAUTH_PROXY_URL | Optional | Override Kolbo OAuth proxy base (default: https://auth.kolbo.ai/oauth/v1) |
VITE_KOLBO_BACKEND | Optional | kolbo (default) or supabase (BYO Supabase) |
VITE_SUPABASE_URL | BYO Supabase only | Your own Supabase project URL |
VITE_SUPABASE_ANON_KEY | BYO Supabase only | Your own Supabase anon key |
All variables are automatically injected by Kolbo App Builder at build time.
MIT
FAQs
Kolbo App Builder SDK — auth, data, storage and AI for generated apps
The npm package @kolbo/app-sdk receives a total of 37 weekly downloads. As such, @kolbo/app-sdk popularity was classified as not popular.
We found that @kolbo/app-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.