
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
cloudkit-js
Advanced tools
CloudKit JS aims to make it easy for you to manage your CloudKit container from your Node.js server.
It's as simple as this
import { CloudKitJs } from 'cloudkit-js';
const lib = new CloudKitJs({
containerName: "iCloud.com.your.container.name",
keyId: "xxx",
privateKeyPath: "eckey.pem"
})
lib.createRecord({
recordType: "MyRecordType",
fields: {
name: { value: "My new record" },
description: { value: "Wow, so easy!" }
}
})
This assumes you've already an active Apple Developer membership and you've got your CloudKit container set up.
Go to CloudKit Dashboard, open your container, and click "Tokens & Keys" on the left menu.
Add a new "Server-to-Server Key" and follow the instructions.
npm install --save cloudkit-js
import { CloudKitJs } from 'cloudkit-js';
const lib = new CloudKitJs({
containerName: "iCloud.com.your.container.name", // Update this with your CloudKit container name
keyId: "xxx", // Put your key ID here
privateKeyPath: "eckey.pem" // Point to your private key file
})
The keyId and privateKeyPath are the values you got from step 1.
Your Key ID is displayed when viewing the server-to-server key on the CloudKit Dashboard.
⚠️ These are secret, so obvz don't put them in source control.
FAQs
A JS library for managing a CloudKit container
The npm package cloudkit-js receives a total of 34 weekly downloads. As such, cloudkit-js popularity was classified as not popular.
We found that cloudkit-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.