
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
booruA node package to search boorus
Only non-EoL versions of Node.js are tested and officially supported. EoL versions are unsupported. Other runtimes (like web, Deno, and Bun) aren't officially supported but issues and PRs are accepted for them.
Post objects that are consistent no matter which booru you usesb for safebooru.org)order:random on sites that support it and using custom code on those that don'tBooru is available on npm:
# Pick your favorite package manager
npm add booru
pnpm add booru
yarn add booru
And available on jsr:
# Pick your favorite runtime
pnpm i jsr:@atorasuunva/booru
deno add jsr:@atorasuunva/booru
bunx jsr add @atorasuunva/booru
import { search, forSite } from 'booru'
const posts = await search('safebooru', ['glaceon'], {
limit: 3,
})
for (const post of posts) {
console.log(post.fileUrl, post.postView)
}
// Or, using alias support and creating
const Booru = require('booru')
Booru.search('safebooru', ['glaceon'], { limit: 3, random: true }).then(
posts => {
for (let post of posts) console.log(post.fileUrl, post.postView)
},
)
// or (using alias support and creating boorus)
const sb = forSite('sb')
const petPosts = await sb.search(['cat', 'dog'], { limit: 2 })
See example.js for more examples
Available here: https://jsr.io/@atorasuunva/booru/doc
booru was built for Node.js, and is only officially supported for Node.js. Issues relating to web are fine, although support might be limited.
It's possible to use booru on the web using webpack (or similar), although your experience may vary. Some websites don't have the proper CORS headers, meaning that API requests to those sites from a browser will fail! This is not an issue I can fix in the package, and requires either that booru to add proper support themselves or for you to find a workaround for CORS.
Post?The basic structure of a Post object looks like:
Post {
data: {/*...*/}, // The raw data from the booru
fileUrl: 'https://aaaa.com/img.jpg', // The direct link to the image, ready to post
id: '124125', // The image ID, as a string
tags: ['cat', 'cute'], // The tags, split into an Array
score: 5, // The score as a Number
source: 'https://ex.com/aaa.png', // Source of the image, if supplied
rating: 's', // Rating of the image
createdAt: Date, // The `Date` this image was created at
postView: 'https://booru.ex/show/12345' // A URL to the post
}
s: 'Safe'
q: 'Questionable'
e: 'Explicit'
u: 'Unrated'
Derpibooru has Safe, Suggestive, Questionable, Explicit, although Suggestive will be shown as q in <Post>.rating
Sure! Just fork this repo, push your changes, and then make a PR.
I'll accept PR based on what they do. Make sure your changes pass the lint (pnpm run lint:fix) and tests (pnpm run test).
Why not?
Add 2 new boorus (furry.booru.org/realbooru.com)
Various Derpibooru fixes
Add TypeScript declarations
Improve TypeScript port
Various other small fixes
FAQs
Search (and do other things) on a bunch of different boorus!
The npm package booru receives a total of 383 weekly downloads. As such, booru popularity was classified as not popular.
We found that booru demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.