
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@mesadev/sdk
Advanced tools
Affected versions:
Official Mesa TypeScript SDK.
This is the primary TypeScript SDK for Mesa. It includes ergonomic REST resources with default org inference.
Node.js runtime is required.
bun add @mesadev/sdk
import { Mesa } from '@mesadev/sdk';
const mesa = new Mesa({
apiKey: process.env.MESA_API_KEY,
});
// Uses org inferred from /whoami
const repo = await mesa.repos.create({ name: 'my-repo' });
// Optional constructor org bypasses /whoami default-org resolution
const mesaWithOrg = new Mesa({
apiKey: process.env.MESA_API_KEY,
org: 'acme',
});
await mesaWithOrg.repos.list();
// Per-call org override
await mesa.repos.list({ org: 'other-org' });
console.log(repo.name);
This package exposes org-inferred REST resources under mesa.*.
Mesa accepts:
apiKey?: string (falls back to MESA_API_KEY in Node)apiUrl?: string (defaults to https://api.mesa.dev/v1)org?: string (optional default org; bypasses /whoami resolution)fetch?: typeof fetchuserAgent?: stringwebhookSecret?: string (used by mesa.webhooks.receive(...))Register typed handlers with mesa.webhooks.on(...) and pass the incoming
request to mesa.webhooks.receive(...). receive verifies the signature,
parses the payload, and dispatches any registered handlers.
import { Hono } from 'hono';
import { Mesa } from '@mesadev/sdk';
const mesa = new Mesa({
apiKey: process.env.MESA_API_KEY,
webhookSecret: process.env.MESA_WEBHOOK_SECRET,
});
mesa.webhooks.on('push', (event) => {
console.log('push:', event.data.updates[0]?.ref);
});
const app = new Hono();
app.post('/webhooks/mesa', async (c) => {
await mesa.webhooks.receive(c.req.raw);
return c.text('ok');
});
@mesadev/sdk is the ergonomic, main SDK.@mesadev/rest is the generated REST package used under the hood.Use @mesadev/rest directly, or call the API with your own HTTP client, when you need low-level REST access beyond the resource namespaces.
If you previously used the older generated @mesadev/sdk package:
apiUrl instead of serverURL/whoami or pass org per callmesa.repos, mesa.changes, etc.); install @mesadev/rest directly when you need generated REST operationsFAQs
Official Mesa TypeScript SDK
The npm package @mesadev/sdk receives a total of 10,178 weekly downloads. As such, @mesadev/sdk popularity was classified as popular.
We found that @mesadev/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.