
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@vercel/blob
Advanced tools
The Vercel Blob JavaScript API client.
npm install @vercel/blob
import * as vercelBlob from '@vercel/blob';
// usage
async function someMethod() {
const blob = await vercelBlob.put(
'profilesv1/user-12345.txt', // pathname for the blob
'Hello World!', // body
{ access: 'public' }, // mandatory options
);
console.log(blob.url);
// https://public.blob.vercel-storage.com/n1g9m63etib6gkcjqjpspsiwe7ea/profilesv1/user-12345-NoOVGDVcqSPc7VYCUAGnTzLTG2qEM2.txt
}
put(pathname, body, options)
Upload a blob to the Vercel Blob API, and returns the URL of the blob.
async function put(
pathname: string,
body: ReadableStream | String | ArrayBuffer | Blob // All fetch body types are supported: https://developer.mozilla.org/en-US/docs/Web/API/fetch#body
options: {
access: 'public', // mandatory, as we will provide private blobs in the future
contentType?: string, // by default inferred from pathname
// `token` defaults to process.env.BLOB_READ_WRITE_TOKEN on Vercel
// and can be configured when you connect more stores to a project
// or using Vercel Blob outside of Vercel
token?: string,
}): Promise<{
size: number;
uploadedAt: Date;
pathname: string;
contentType: string;
contentDisposition: string;
url: string;
}> {}
Delete one or multiple blobs by their full URL. Returns the deleted blob(s) or null when not found.
async function del(
url: string | string[],
options?: {
token?: string;
},
): Promise<
| {
size: number;
uploadedAt: Date;
pathname: string;
contentType: string;
contentDisposition: string;
url: string;
}
| null
| ({
size: number;
uploadedAt: Date;
pathname: string;
contentType: string;
contentDisposition: string;
url: string;
} | null)[]
> {}
Get the metadata of a blob by its full URL. Returns null
when the blob does not exist.
async function head(
url: string,
options?: {
token?: string;
},
): Promise<{
size: number;
uploadedAt: Date;
pathname: string;
contentType: string;
contentDisposition: string;
url: string;
} | null> {}
List blobs and get their metadata in the store. With an optional prefix and limit. Paginate through them.
async function list(options?: {
token?: string;
limit?: number; // defaults to 1,000
prefix?: string;
cursor?: string;
}): Promise<{
blobs: {
size: number;
uploadedAt: Date;
pathname: string;
contentType: string;
contentDisposition: string;
url: string;
}[];
cursor?: string;
hasMore: boolean;
}> {}
This example shows a form uploading a file to the Vercel Blob API.
// /app/UploadForm.tsx
'use client';
import type { BlobResult } from '@vercel/blob';
import { useState } from 'react';
export default function UploadForm() {
const [blob, setBlob] = useState<BlobResult | null>(null);
return (
<>
<form
action="/api/upload"
method="POST"
encType="multipart/form-data"
onSubmit={async (event) => {
event.preventDefault();
const formData = new FormData(event.currentTarget);
const response = await fetch('/api/upload', {
method: 'POST',
body: formData,
});
const blob = (await response.json()) as BlobResult;
setBlob(blob);
}}
>
<input type="file" name="file" />
<button type="submit">Upload</button>
</form>
{blob && (
<div>
Blob url: <a href={blob.url}>{blob.url}</a>
</div>
)}
</>
);
}
// /app/api/upload/route.ts
import * as vercelBlob from '@vercel/blob';
import { NextResponse } from 'next/server';
export async function POST(request: Request) {
const form = await request.formData();
const file = form.get('file') as File;
if (!file) {
return NextResponse.json(
{ message: 'No file to upload.' },
{ status: 400 },
);
}
const blob = await vercelBlob.put(file.name, file, { access: 'public' });
return NextResponse.json(blob);
}
This will paginate through all your blobs in chunks of 1,000 blobs.
You can control the number of blobs in each call with limit
.
let hasMore = true;
let cursor: string | undefined;
while (hasMore) {
const listResult = await vercelBlob.list({
cursor,
});
console.log(listResult);
hasMore = listResult.hasMore;
cursor = listResult.cursor;
}
All methods of this module will throw if the request fails for either:
You should acknowledge that in your code by wrapping our methods in a try/catch block:
try {
await vercelBlob.put('foo', 'bar');
} catch (error) {
if (error instanceof vercelBlob.BlobAccessError) {
// handle error
} else {
// rethrow
throw error;
}
}
pnpm changeset
git commit -am "New version"
Once such a commit gets merged in main, then GitHub will open a versioning PR you can merge. And the package will be automatically published to npm.
When using Serverless or Edge Functions on Vercel, the request body size is limited to 4MB.
When you want to send files larger than that to Vercel Blob, you can do so by using @vercel/blob
from a regular Node.js script context (like at build time). This way the request body will be sent directly to Vercel Blob and not via an Edge or Serverless Function.
We plan to allow sending larger files to Vercel Blob from browser contexts soon.
@vercel/blob
reads the token from the environment variables on process.env
. In general, process.env
is automatically populated from your .env
file during development, which is created when you run vc env pull
. However, Vite does not expose the .env
variables on process.env.
You can fix this in one of following two ways:
process.env
yourself using something like dotenv-expand
:pnpm install --save-dev dotenv dotenv-expand
// vite.config.js
import dotenvExpand from 'dotenv-expand';
import { loadEnv, defineConfig } from 'vite';
export default defineConfig(({ mode }) => {
// This check is important!
if (mode === 'development') {
const env = loadEnv(mode, process.cwd(), '');
dotenvExpand.expand({ parsed: env });
}
return {
...
};
});
$env/static/private
:import { put } from '@vercel/blob';
+ import { BLOB_TOKEN } from '$env/static/private';
const kv = await head("filepath", {
- token: '<token>',
+ token: BLOB_TOKEN,
});
await kv.set('key', 'value');
FAQs
The Vercel Blob JavaScript API client
The npm package @vercel/blob receives a total of 761,240 weekly downloads. As such, @vercel/blob popularity was classified as popular.
We found that @vercel/blob demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.