
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
curseforge-api
Advanced tools
This is a JavaScript module built around the new CurseForge for Studios API (also formerly known as "Eternal API" and "CurseForge Core API") following the deprecation of the older, unnofficial API. It is designed to be easy to use and has zero dependencies 🙌. More information about the CurseForge for Studios API is available here.
This module provides TypeScript typings.
This module uses fetch() under the hood to make requests. However, if you're using Node.js, keep in mind that fetch() was not added until v17.5.0, and is behind the --experimental-fetch flag until v18.0.0. For this reason, where fetch() is unavailable, the module can use a fetch polyfill such as node-fetch.
Documentation is available here and is automatically generated from the source with TypeDoc.
Import the package depending on what type of environment you're using it in.
Install the package via npm:
npm install curseforge-api
and import it in your script:
import {CurseForgeClient} from 'curseforge-api';
Import modules directly via CDN (for example, esm.sh, Skypack, jsDelivr or unpkg):
// Recommended for Deno
import {CurseForgeClient} from 'https://esm.sh/curseforge-api';
// OR
import {CurseForgeClient} from 'https://cdn.skypack.dev/curseforge-api';
// OR
import {CurseForgeClient} from 'https://cdn.jsdelivr.net/npm/curseforge-api';
// OR
import {CurseForgeClient} from 'https://unpkg.com/curseforge-api'
Start by creating a client, which you will use to make most API queries:
const client = new CurseForgeClient('YOUR_API_KEY');
fetch() PolyfillIf you're using Node.js < v17.5.0, you'll want to provide a fetch() polyfill such as node-fetch:
import fetch from 'node-fetch';
// Pass fetch to the client
const client = new CurseForgeClient('YOUR_API_KEY', {fetch});
You can also provide a different polyfill, for example, if you're running this in a browser environment and target older browsers that don't support fetch(). As seen above, simply pass the polyfilled fetch function to the client constructor via the options.
All classes, functions, enums, and types are documented here.
import {CurseForgeGameEnum} from 'curseforge-api';
const modsResults = await client.searchMods(CurseForgeGameEnum.Minecraft, {slug: 'jei'});
const jei = modsResults.data[0];
console.log(jei.name); // => 'Just Enough Items (JEI)'
console.log(jei.id); // => 238222
const jei = await client.getMod(238222);
console.log(jei.name); // => 'Just Enough Items (JEI)'
console.log(jei.id); // => 238222
import {CurseForgeModLoaderType} from 'curseforge-api';
const files = await mod.getFiles(238222, {
gameVersion: '1.18.2',
modLoaderType: CurseForgeModLoaderType.Forge,
pageSize: 1,
});
console.log(files.data[0].fileName); // => 'jei-1.18.2-9.7.1.232.jar'
const file = await mod.getFile(3847103);
console.log(file.displayName); // => 'jei-1.18.2-9.7.0.209.jar'
console.log(await file.getDownloadURL()); // => 'https://edge.forgecdn.net/files/3847/103/jei-1.18.2-9.7.0.209.jar'
For convenience, the game IDs that were available at the time of publishing are available as an enum. You can use this wherever you need to provide a game ID.
There are also enums and typings available for all documented types on the CurseForge for Studios API.
FAQs
An easy to use library to help you consume the CurseForge Core API
The npm package curseforge-api receives a total of 12 weekly downloads. As such, curseforge-api popularity was classified as not popular.
We found that curseforge-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.