
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@microsoft/msgraph-beta-sdk-invitations
Advanced tools
Get started with the Microsoft Graph SDK for Typescript by integrating the Microsoft Graph API into your Typescript application!
Note: this SDK allows you to build applications using the beta of Microsoft Graph. If you want to try the latest Microsoft Graph APIs.
Note: the Microsoft Graph Typescript SDK is currently in Pre-Release.
# this will install the main package
npm install @microsoft/msgraph-beta-sdk
# this will install the authentication provider for Azure Identity / Microsoft Entra
npm install @microsoft/kiota-authentication-azure @azure/identity
# this will install the fluent API package for the users API paths
npm install @microsoft/msgraph-beta-sdk-users
Note: we are working to add the getting started information for Typescript to our public documentation, in the meantime the following sample should help you getting started.
Register your application by following the steps at Register your app with the Microsoft Identity Platform.
An instance of the GraphBetaServiceClient class handles building client. To create a new instance of this class, you need to provide an instance of AuthenticationProvider, which can authenticate requests to Microsoft Graph.
// @azure/identity
const credential = new AuthorizationCodeCredential(
'YOUR_TENANT_ID',
'YOUR_CLIENT_ID',
'YOUR_CLIENT_SECRET',
'AUTHORIZATION_CODE',
'REDIRECT_URL',
);
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["User.Read"]);
// @azure/identity
const credential = new ClientCertificateCredential(
'YOUR_TENANT_ID',
'YOUR_CLIENT_ID',
'YOUR_CERTIFICATE_PATH',
);
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["https://graph.microsoft.com/.default"]);
// @azure/identity
const credential = new ClientSecretCredential(
'YOUR_TENANT_ID',
'YOUR_CLIENT_ID',
'YOUR_CLIENT_SECRET',
);
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["https://graph.microsoft.com/.default"]);
// @azure/identity
const credential = new OnBehalfOfCredential({
tenantId: 'YOUR_TENANT_ID',
clientId: 'YOUR_CLIENT_ID',
clientSecret: 'YOUR_CLIENT_SECRET',
userAssertionToken: 'JWT_TOKEN_TO_EXCHANGE',
});
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["https://graph.microsoft.com/.default"]);
// @azure/identity
const credential = new DeviceCodeCredential({
tenantId: 'YOUR_TENANT_ID',
clientId: 'YOUR_CLIENT_ID',
userPromptCallback: (info) => {
console.log(info.message);
},
});
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["User.Read"]);
// @azure/identity
const credential = new InteractiveBrowserCredential({
tenantId: 'YOUR_TENANT_ID',
clientId: 'YOUR_CLIENT_ID',
redirectUri: 'http://localhost',
});
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["User.Read"]);
// @azure/identity
const credential = new UsernamePasswordCredential(
'YOUR_TENANT_ID',
'YOUR_CLIENT_ID',
'YOUR_USER_NAME',
'YOUR_PASSWORD',
);
// @microsoft/kiota-authentication-azure
const authProvider = new AzureIdentityAuthenticationProvider(credential, ["User.Read"]);
You must get a GraphServiceClient object to make requests against the service.
const requestAdapter = new FetchRequestAdapter(authProvider);
const graphServiceClient = createGraphServiceClient(requestAdapter);
You must get a GraphBetaServiceClient object to make requests against the service.
const requestAdapter = new FetchRequestAdapter(authProvider);
const graphBetaServiceClient = createGraphBetaServiceClient(requestAdapter);
After you have a GraphBetaServiceClient that is authenticated, you can begin making calls against the service. The requests against the service look like our REST API.
To retrieve the user's detailed information:
import { FetchRequestAdapter } from "@microsoft/kiota-http-fetchlibrary";
import { createGraphBetaServiceClient } from "@microsoft/msgraph-beta-sdk";
import "@microsoft/msgraph-beta-sdk-users";
const requestAdapter = new FetchRequestAdapter(authProvider);
const graphBetaServiceClient = createGraphBetaServiceClient(requestAdapter);
const jane = await graphBetaServiceClient.users.byUserId("jane@contoso.com").get();
For more detailed documentation, see:
For known issues, see issues.
The Microsoft Graph SDK is open for contribution. To contribute to this project, see Contributing.
Copyright (c) Microsoft Corporation. All Rights Reserved. Licensed under the MIT license.
FAQs
Invitations fluent API for Microsoft Graph
We found that @microsoft/msgraph-beta-sdk-invitations demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.