
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
Convenience wrapper for Got to interact with the GitHub API
Unless you're already using Got, you should probably use GitHub's own @octokit/rest.js or @octokit/graphql.js packages instead.
npm install gh-got
Instead of:
import got from 'got';
const token = 'foo';
const {body} = await got('https://api.github.com/users/sindresorhus', {
json: true,
headers: {
'accept': 'application/vnd.github.v3+json',
'authorization': `token ${token}`
}
});
console.log(body.login);
//=> 'sindresorhus'
You can do:
import ghGot from 'gh-got';
const {body} = await ghGot('users/sindresorhus', {
context: {
token: 'foo'
}
});
console.log(body.login);
//=> 'sindresorhus'
Or:
import ghGot from 'gh-got';
const {body} = await ghGot('https://api.github.com/users/sindresorhus', {
context: {
token: 'foo'
}
});
console.log(body.login);
//=> 'sindresorhus'
Same API as got, including options, the stream API, aliases, pagination, etc, but with some additional options below.
Errors are improved by using the custom GitHub error messages. Doesn't apply to the stream API.
gh-got specific optionsType: string
GitHub access token.
Can be set globally with the GITHUB_TOKEN environment variable.
Type: string
Default: https://api.github.com/
To support GitHub Enterprise.
Can be set globally with the GITHUB_ENDPOINT environment variable.
Type: object
Can be specified as a plain object and will be serialized as JSON with the appropriate headers set.
Responses and errors have a .rateLimit property with info about the current rate limit. (This is not yet implemented for the stream API)
import ghGot from 'gh-got';
const {rateLimit} = await ghGot('users/sindresorhus');
console.log(rateLimit);
//=> {limit: 5000, remaining: 4899, reset: [Date 2018-12-31T20:45:20.000Z]}
Authorization for GitHub uses the following logic:
options.headers.authorization is passed to gh-got, then this will be used as first preference.options.token is provided, then the authorization header will be set to token <options.token>.options.headers.authorization and options.token are not provided, then the authorization header will be set to token <process.env.GITHUB_TOKEN>In most cases, this means you can simply set GITHUB_TOKEN, but it also allows it to be overridden by setting options.token or options.headers.authorization explicitly. For example, if authenticating as a GitHub App, you could do the following:
import ghGot from 'gh-got';
const options = {
headers: {
authorization: `Bearer ${jwt}`
}
};
const {body} = await ghGot('app', options);
console.log(body.name);
//=> 'MyApp'
See the Got docs.
Node-fetch is a lightweight module that brings window.fetch to Node.js. While it is not specifically designed for GitHub API interactions, it can be used to make HTTP requests to any API, including GitHub's. Compared to gh-got, node-fetch requires more manual setup for authentication and handling GitHub-specific features.
Axios is a promise-based HTTP client for the browser and Node.js. It is widely used for making HTTP requests and can be configured to interact with the GitHub API. Compared to gh-got, axios provides a more general-purpose HTTP client with a larger community and more extensive documentation.
FAQs
Convenience wrapper for Got to interact with the GitHub API
The npm package gh-got receives a total of 490,865 weekly downloads. As such, gh-got popularity was classified as popular.
We found that gh-got demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.