
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@postbag/sdk
Advanced tools
Typed TypeScript client for the Postbag API. Generated from the server's /openapi.json
(the truth — see api/openapi.yaml), so it is always in sync with what apps/server
actually serves.
import { createClient, submit } from "@postbag/sdk"
// Management API (/v1/*) — cookie session (dashboard) or an API key (agents, scripts).
const client = createClient({ baseUrl: "https://api.postbag.dev", apiKey: "pb_live_…" })
const { data, error } = await client.GET("/v1/forms")
// Public submit endpoint (/s/{formId}) — no auth, works from a browser or a server.
await submit("https://api.postbag.dev/s/fm_8f3kq2", { email: "you@example.com" })
Every operation is also keyed by its stable operationId (see docs/AGENT-NATIVE.md §6 —
these are the same names the postbag CLI and @postbag/mcp tools use):
import type { operations } from "@postbag/sdk"
type FormsCreateBody = operations["forms_create"]["requestBody"]["content"]["application/json"]
pnpm --filter @postbag/sdk generate
Regenerates src/schema.d.ts from the committed api/openapi.yaml (itself generated by
pnpm openapi:export from the Zod route definitions in apps/server — no running server
needed for either step). schema.d.ts is committed so consumers don't need to run
anything to typecheck.
FAQs
Unknown package
We found that @postbag/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.