
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
alfresco-javascript-console
Advanced tools
write and run JavaScript scripts against an Alfresco repository directly from the IDE
Run JavaScript scripts against an Alfresco repository from VS Code or the command line.
Supports both OOTBee JavaScript Console (actively maintained) and the original fme AG JavaScript Console, with automatic variant detection.
Install from the VS Code Marketplace, or search for "Alfresco Javascript Console" in VS Code extensions.
npm install -g alfresco-javascript-console
Ctrl+Shift+P → "Configure Alfresco Server"Ctrl+Shift+R to executealf- for suggestions)| Command | Shortcut | Description |
|---|---|---|
| Run Script | Ctrl+Shift+R | Execute current script against Alfresco |
| Configure Server | Set up server connection | |
| Open Console Panel | Show execution parameter panel | |
| Add Server Profile | Add a new server profile | |
| Switch Server Profile | Switch active profile | |
| Edit Server Profile | Edit an existing profile | |
| Delete Server Profile | Remove a profile |
| Setting | Description |
|---|---|
alfrescoJsConsole.server.url | Alfresco server URL |
alfrescoJsConsole.server.consoleVariant | Console variant: auto, ootbee, or fme |
alfrescoJsConsole.server.username | Username for authentication |
alfrescoJsConsole.execution.defaultTransaction | Default transaction type (readonly / readwrite) |
alfrescoJsConsole.execution.defaultRunAs | Default run-as user |
Type any prefix and press Tab:
alf-search · alf-props · alf-create · alf-people · alf-home · alf-workflow · alf-perms · alf-aspects · alf-children
Zero-dependency command-line tool for running Alfresco scripts from the terminal or CI pipelines.
# Run a script file
alfresco-js-console run script.js --server https://localhost:8080/alfresco --username admin --password admin
# Read from stdin
cat script.js | alfresco-js-console run -
# Use a saved profile
alfresco-js-console run script.js
# With FreeMarker template
alfresco-js-console run script.js --template output.ftl
# JSON output (for scripting/AI tooling)
alfresco-js-console run script.js --json
# Add a profile
alfresco-js-console profile add
# List profiles
alfresco-js-console profile list
# Switch active profile
alfresco-js-console profile switch <name>
# Delete a profile
alfresco-js-console profile delete <name>
Profiles are stored in ~/.alfresco-js-console/config.json with 0600 permissions.
Pass a FreeMarker template file with --template to format script output. Populate the template model by setting properties on the model object in your script:
script.js:
var children = companyhome.children;
model.nodes = children;
model.user = person.properties["cm:userName"];
output.ftl:
User: ${user}
<#list nodes as node>
${node.name} (${node.typeShort}) - ${node.nodeRef}
</#list>
alfresco-js-console run script.js --template output.ftl
| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | Script execution error |
| 2 | Configuration or usage error |
// print() streams output in real-time
print("Hello from Alfresco!");
print("Company Home: " + companyhome.name);
print("Current User: " + person.properties["cm:userName"]);
var children = companyhome.children;
print("Company Home has " + children.length + " children:");
for (var i = 0; i < Math.min(children.length, 5); i++) {
print(" - " + children[i].name);
}
// model.* populates FreeMarker template variables
model.nodes = children;
model.user = person.properties["cm:userName"];
MIT
FAQs
write and run JavaScript scripts against an Alfresco repository directly from the IDE
We found that alfresco-javascript-console demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.