Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@readdle/google-auth-library
Advanced tools
Google APIs Authentication Client Library for Node.js
This is Google's officially supported node.js client library for using OAuth 2.0 authorization and authentication with Google APIs.
This library is distributed on npm
. To add it as a dependency,
run the following command:
$ npm install google-auth-library --save
This library provides an implementation of Application Default Credentials for Node.js.
The Application Default Credentials provide a simple way to get authorization credentials for use in calling Google APIs.
They are best suited for cases when the call needs to have the same identity and authorization level for the application independent of the user. This is the recommended approach to authorize calls to Cloud APIs, particularly when you're building an application that uses Google Compute Engine.
To use Application Default Credentials
, You first need to download a set of
JSON credentials for your project. Go to APIs & Auth > Credentials in
the Google Developers Console and select
Service account from the Add credentials dropdown.
This file is your only copy of these credentials. It should never be committed with your source code, and should be stored securely.
Once downloaded, store the path to this file in the
GOOGLE_APPLICATION_CREDENTIALS
environment variable.
Before making your API call, you must be sure the API you're calling has been
enabled. Go to APIs & Auth > APIs in the
Google Developers Console and enable the APIs you'd like to
call. For the example below, you must enable the DNS API
.
As long as you update the environment variable below to point to your JSON credentials file, and the fill in the placeholder variables from your project, the following snippet should work.
var google = require('googleapis');
var GoogleAuth = require('google-auth-library');
var authFactory = new GoogleAuth();
var dns = google.dns('v1');
authFactory.getApplicationDefault(function(err, authClient) {
if (err) {
console.log('Authentication failed because of ', err);
return;
}
if (authClient.createScopedRequired && authClient.createScopedRequired()) {
var scopes = ['https://www.googleapis.com/auth/cloud-platform'];
authClient = authClient.createScoped(scopes);
}
var request = {
// TODO: Change placeholders below to values for parameters to the 'get' method:
// Identifies the project addressed by this request.
project: "",
// Identifies the managed zone addressed by this request. Can be the managed zone name or id.
managedZone: "",
// The identifier of the requested change, from a previous ResourceRecordSetsChangeResponse.
changeId: "",
// Auth client
auth: authClient
};
dns.changes.get(request, function(err, result) {
if (err) {
console.log(err);
} else {
console.log(result);
}
});
});
See CONTRIBUTING.
This library is licensed under Apache 2.0. Full license text is available in LICENSE.
FAQs
Google APIs Authentication Client Library for Node.js
The npm package @readdle/google-auth-library receives a total of 1 weekly downloads. As such, @readdle/google-auth-library popularity was classified as not popular.
We found that @readdle/google-auth-library demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.