
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
filestack-js
Advanced tools
Javascript SDK for the Filestack API and content management system.
npm install filestack-js
ES module:
import * as filestack from 'filestack-js';
const client = filestack.init('apikey');
UMD module:
<script src="//static.filestackapi.com/filestack-js/1.x.x/filestack.min.js"></script>
<script>
const client = filestack.init('apikey');
</script>
CommonJS module:
const client = require('filestack-js').init('apikey');
The package.json specifies two separate modules:
main for the CommonJS module (intended for Node runtimes)browser for the pre-bundled ES module (intended for browser runtimes)Node projects which depend on filestack-js will follow the main field in package.json. When building for the browser, newer tools (like Webpack, Rollup, and Parcel) follow the browser field, which will resolve to the pre-bundled ES module. Both modules follow the same API, but some methods behave differently based on their runtime. For example, client.upload treats the file argument as a file path in Node but in browsers it assumes a Blob object.
The pre-bundled browser module is also available in UMD format. This is useful if you are using script tags on a web page instead of bundling your application. It can be retrieved from both the Filestack CDN and the unpkg CDN:
Upload image
Open picker
Open picker in inline mode
Crop images
Multiple drop panes
Preview
Import using RequireJS
Retrieve image data
Transform image
Custom Picker CSS
Assign file to user
Examples can be run locally with:
npm run examples
If you are here to use the picker widget, it can be initialized from the Filestack client by calling client.picker(options). Options for the picker are documented here.
The picker instance returned from client.picker can be controlled with a few methods:
displayMode.Please see our examples above to learn more about customizing the picker for your use case.
https://filestack.github.io/filestack-js/
This library requires an environment that implements the Promise object spec.
If you target IE11 or iOS before 8.0 you will need to add a Promise polyfill to your page or application.
Polyfills we recommend:
Module (for bundling):
Script (for script tag):
Most tests in this library are expected to interface with actual backend services. Because we like to run tests during development, these services are mocked during unit testing.
All tests are using Mocha. Browser tests are run with Karma.
To run units:
npm test
To run integration tests:
npm run test:integration
Integration tests require a .env file in the root of your project with the following fields:
BROWSERSTACK_USERNAME=
BROWSERSTACK_ACCESS_KEY=
TEST_APIKEY=
TEST_CLOUD_APIKEY=
TEST_INTELLIGENT_APIKEY=
TEST_SECURE_APIKEY=
TEST_SIGNATURE=
TEST_POLICY=
TEST_FILELINK=
TEST_SECURE_FILELINK=
You will need to acquire this data from a Filestack developer if you plan on running the integration suite.
We follow the conventional commits specification to ensure consistent commit messages and changelog formatting.
FAQs
Official JavaScript library for Filestack
The npm package filestack-js receives a total of 31,948 weekly downloads. As such, filestack-js popularity was classified as popular.
We found that filestack-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.