
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
github-oauth-express
Advanced tools
A small package to enable Github Login and access to your Express application
access_token of a Github account for a particular client. So that we can call Github's user specific APIs.client_id, client_secret.
Settings -> Developer Settings -> OAuth Apps -> New OAuth App.callback URL.`https://github.com/login/oauth/authorize?client_id=${YOUR_CLIENT_ID}`;

Here you can obtain authToken using both callback way as well as promise way.
const express = require('express');
const app = express();
const githubAPI = require('github-oauth-express');
// YOUR EXPRESS APPLICATION
githubAPI(
app, // Send your app instance to get OAuth Access
{
clientId: 'YOUR_CLIENT_ID',
clientSecret: 'YOUR_CLIENT_SECRET',
redirectURL: '/oauth-call'
}
)
.then(authToken => {
console.log('authToken:', authToken);
})
.catch(err => console.log(err));
const express = require('express');
const app = express();
const githubAPI = require('github-oauth-express');
// YOUR EXPRESS APPLICATION
githubAPI(
app, // Send your app instance to get OAuth Access
{
clientId: 'YOUR_CLIENT_ID',
clientSecret: 'YOUR_CLIENT_SECRET',
redirectURL: '/oauth-call'
},
(err, authToken) => {
if (err) {
console.log('err:', err);
return;
}
console.log('authToken:', authToken);
}
);
Once Auth Token obtained you can call Githubs Developer APIs by just adding a header in each request as
{
"headers": {
"Accept": "application/json"
}
}
FAQs
A small package to enable Github Login and access to your Express application
The npm package github-oauth-express receives a total of 1 weekly downloads. As such, github-oauth-express popularity was classified as not popular.
We found that github-oauth-express demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.