
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
copilot-node-sdk
Advanced tools
The Assembly.js Node SDK provides easy to call functions written in TypeScript for interacting with the Assembly REST API. Right now this is a TypeScript only package. In the future we will have a Vanilla JS package with a corresponding @types package to go along with it.
This SDK is intended to be used on the server-side only. We do not currently offer a package for client-side development.
npm install @assembly-js/node-sdk
# or
yarn add @assembly-js/node-sdk
import { assemblyApi } from '@assembly-js/node-sdk';
const assembly = assemblyApi({ apiKey: YOUR_API_KEY_HERE });
If you're building a Marketplace app you should go through one additional step of fetching a query parameter that gets passed into the App URL when rendered in the dashboard: ?token=TOKEN_IS_HERE
Grab that token from the URL and pass it in to the assemblyApi configuration object.
import { assemblyApi } from '@assembly-js/node-sdk';
const assembly = assemblyApi({
apiKey: YOUR_API_KEY_HERE,
token: searchParams.token,
});
If you're migrating from copilot-node-sdk, the following changes are needed:
# Remove old package
npm uninstall copilot-node-sdk
# Install new package
npm install @assembly-js/node-sdk
// Before
import { copilotApi } from 'copilot-node-sdk';
const copilot = copilotApi({ apiKey: YOUR_API_KEY });
// After
import { assemblyApi } from '@assembly-js/node-sdk';
const assembly = assemblyApi({ apiKey: YOUR_API_KEY });
| Old Variable | New Variable | Notes |
|---|---|---|
COPILOT_ENV | ASSEMBLY_ENV | Both work, new takes precedence |
COPILOT_DEBUG | ASSEMBLY_DEBUG | Both work, new takes precedence |
For a gradual migration, the old names are still available but deprecated:
// These still work but are deprecated
import { copilotApi, type CopilotAPI } from '@assembly-js/node-sdk';
yarnyarn generate-apiyarn test to produce a successful responseyarn test:fail to product a response that fails because of a missing env variable.For additional logging you can set the environment variable ASSEMBLY_DEBUG to any truthy value. This is useful if you'd like to see SDK logs while developing in an application's codebase.
The following fields are deprecated and will be removed in a future version of the SDK:
companyId (deprecated in v3.15.0)companyIds array insteadrecipientId (deprecated in v3.15.0)clientId and companyId insteadBefore (deprecated):
// Creating a client with single company
await assembly.createClient({
companyId: 'company-uuid-here',
// ... other fields
});
// Creating an invoice with recipient ID
await assembly.createInvoice({
recipientId: 'recipient-uuid-here',
// ... other fields
});
After (recommended):
// Creating a client with multiple companies support
await assembly.createClient({
companyIds: ['company-uuid-here'], // Now an array
// ... other fields
});
// Creating an invoice with explicit client and company targeting
await assembly.createInvoice({
clientId: 'client-uuid-here',
companyId: 'company-uuid-here',
// ... other fields
});
When using deprecated fields, you'll see:
FAQs
The Assembly.js Node.JS SDK
The npm package copilot-node-sdk receives a total of 197 weekly downloads. As such, copilot-node-sdk popularity was classified as not popular.
We found that copilot-node-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.