
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
fred-openai
Advanced tools
The OpenAI Node.js library provides convenient access to the OpenAI API from Node.js applications. Most of the code in this library is generated from our OpenAPI specification.
Important note: this library is meant for server-side usage only, as using it in client-side browser code will expose your secret API key. See here for more details.
$ npm install openai
The library needs to be configured with your account's secret key, which is available on the website. We recommend setting it as an environment variable. Here's an example of initializing the library with the API key loaded from an environment variable and creating a completion:
const { Configuration, OpenAIApi } = require("openai");
const configuration = new Configuration({
apiKey: process.env.OPENAI_API_KEY,
});
const openai = new OpenAIApi(configuration);
const completion = await openai.createCompletion({
model: "text-davinci-003",
prompt: "Hello world",
});
console.log(completion.data.choices[0].text);
Check out the full API documentation for examples of all the available functions.
All of the available API request functions additionally contain an optional final parameter where you can pass custom axios request options, for example:
const completion = await openai.createCompletion(
{
model: "text-davinci-003",
prompt: "Hello world",
},
{
timeout: 1000,
headers: {
"Example-Header": "example",
},
}
);
API requests can potentially return errors due to invalid inputs or other issues. These errors can be handled with a try...catch statement, and the error details can be found in either error.response or error.message:
try {
const completion = await openai.createCompletion({
model: "text-davinci-003",
prompt: "Hello world",
});
console.log(completion.data.choices[0].text);
} catch (error) {
if (error.response) {
console.log(error.response.status);
console.log(error.response.data);
} else {
console.log(error.message);
}
}
Streaming completions (stream=true) are not natively supported in this package yet, but a workaround exists if needed.
All breaking changes for major version releases are listed below.
createCompletion(engineId, params) changed to createCompletion(params). The value previously passed in as the engineId argument should now be passed in as model in the params object (e.g. createCompletion({ model: "text-davinci-003", ... }))createCompletionFromModel(params) calls with createCompletion(params)Thank you to ceifa for creating and maintaining the original unofficial openai npm package before we released this official library! ceifa's original package has been renamed to gpt-x.
FAQs
Node.js library for the OpenAI API
The npm package fred-openai receives a total of 2 weekly downloads. As such, fred-openai popularity was classified as not popular.
We found that fred-openai demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.