
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Typed TypeScript SDK for the Salesforce Commerce Cloud Account Manager REST API.
The AM API is largely undocumented. ccam-sdk is a first-class, documented TypeScript library covering every AM resource: users, organizations, API clients, roles, realms, permissions, service types, org configurations, and instances. It powers the @j-256/ccam CLI but is also designed for direct use in your own tooling.
sort params)CcamError, CcamAuthError, CcamNotFoundError)npm install ccam-sdk
Requires Node.js 22 or later.
import { CcamClient } from 'ccam-sdk';
const client = new CcamClient({
clientId: 'your-client-id',
clientSecret: 'your-client-secret',
host: 'https://account.demandware.com' // optional, this is the default
});
// List users with pagination
const result = await client.users.list({ page: 0, size: 25 });
console.log(result.content);
console.log(`Page ${result.page.number + 1} of ${result.page.totalPages}`);
// Get user by login with expanded organizations
const user = await client.users.getByLogin('user@example.com', {
expand: 'organizations'
});
// List roles with sorting
const roles = await client.roles.list({
page: 0,
size: 50,
sort: { field: 'name', direction: 'asc' }
});
OAuth2 with four grant types: client_credentials, password, authorization_code (with PKCE), and refresh_token. Two contexts: client-only (system) or client + user (user-scoped). Token caching is built in; supply persistence callbacks if you want refresh tokens to survive process restarts.
Credentials can come from explicit constructor options or environment variables (CCAM_CLIENT_ID, CCAM_CLIENT_SECRET, CCAM_USER, CCAM_USER_PASSWORD, CCAM_HOST).
| SDK property | Resource |
|---|---|
client.users | Users |
client.organizations | Organizations |
client.apiClients | API Clients |
client.roles | Roles |
client.realms | Realms |
client.permissions | Permissions |
client.serviceTypes | Service Types |
Most resources support paginated list, get(id), and resource-specific finders (findByOrg, findByRole, findByOrgAndRole, etc.). Users and API clients support full CRUD; organizations support update.
If you want a command-line tool instead of (or in addition to) the SDK, install @j-256/ccam:
npm install -g @j-256/ccam
ccam user list --org abc123 --format csv > users.csv
MIT
FAQs
Typed SDK for the Salesforce Commerce Cloud Account Manager REST API
We found that ccam-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.