
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@nypl/nypl-core-objects
Advanced tools
Exposes objects from NYPL/nypl-core as easy-to-work-with datastructures
As of version 3.0.0, this module fetches data asyncronously and depends on Node 18.
Support for v2 is dropped because v2 -> v3 is a easy migration. Apps using version 2x should update to Node18+ and use version 3x.
Apps using version 1x should also update to Node18 and use v3. However, because apps using that version are on much older Nodes (i.e. have a steeper migration path), we will continue to support the 1x version of this module for a while - until all apps start using the 3x version of this module.
This node module loads JSON-LD documents from NYPL/nypl-core and turns them into useful lookups for use in your app. These lookups are intentionally simplified representations of the data and do not include all properties in the original JSON-LD documents.
Some non-JS apps want to use these mappings.
By running: npm run build-mappings.
The mappings are written to ./output/.
Those files can be pushed to S3 so any application can parse them as simple JSON. This repo may, one day, stop exporting objects and just be a means of generating JSON artifacts for pushing to S3.
npm run deploy-[qa|production]
This command is cp, not sync.
It uploads any new or updated files, but does not remove deleted files.
To push a pre-release to S3 for testing, set NYPL_CORE_VERSION, e.g.:
NYPL_CORE_VERSION=v1.0.1a npm run deploy-qa
"@nypl/nypl-core-objects": "https://github.com/NYPL/nypl-core-objects.git#SOME-TAG-OR-REF"
"@nypl/nypl-core-objects": "VERSION"
// create a mapping from Sierra codes to Recap Codes
const nyplCoreObjects = require('@nypl/nypl-core-objects')
const bySierraLocation = await nyplCoreObjects('by-sierra-location')
// get its ReCAP code
let code = bySierraLocation['mal']['recapLocation']['code']
// get its ReCAP name
let humanName = bySierraLocation['mal']['recapLocation']['label']
// get its ReCAP eddRequestablity
let EddRequestability = bySierraLocation['mal']['recapLocation']['eddRequestable']
For a comprehensive list of availability see the implementation of factories mentioned nypl-core-objects.js
A specialized utility is included for translating between prefixed and "split" NYPL identifiers:
const NyplSourceMapper = require('@nypl/nypl-core-objects/lib/nypl-source-mapper')
...
const sourceMapper = await NyplSourceMapper.instance()
const { nyplSource, id, type } = sourceMapper.splitIdentifier('b12082323')
This repo has two target branches:
master for Node14+ support (module versions 3x)v1-node6 for Node6 support (module version 1x)All PRs should target master and/or v1-node6. Business logic changes should generally result in two PRs - one for each target branch.
Once the PR has been approved and merged, check out the target branch locally and:
package.jsonnvm use; npm i to update package-lock.jsongit tag -a v2.1.1)git push --tags)npm publish --dry-run to verify nothing is being packaged that should not benpm publishv1.x) add a tag to prevent NPM from updating the latest tag:
npm publish --dry-run. This flag is not supported by node 6.npm publish --tag legacy-node6-supportnpm run deploy-[qa|production]FAQs
Exposes objects from NYPL/nypl-core as easy-to-work-with datastructures
We found that @nypl/nypl-core-objects demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.