
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
graze-client
Advanced tools
This is a simple Typescript package for interacting with the Graze API. The API is undocumented and not officially supported, but this package was made with their blessing.
npm install graze-client
This package is under development, so if you find bugs, please report. Known issues include:
Authentication is currently cookie-based and a little hacky. You will need to log into Graze in your browser, then copy the cookie from your browser's developer tools, and pass it as a string to the GrazeService.
There are two exports:
GrazeServiceimport { GrazeService, F, Algo, FullForm } from "graze-client";
const graze = new GrazeService({
apiUrl: "https://api.graze.social",
cookie: "<change this>",
userId: 15,
});
// get feets
const myFeeds = await graze.getFeeds();
const feed = await graze.getFeed({ path: { feedId: 1234 } });
// hide a post
await graze.hidePost({
payload: { algo_id: 1234, at_uri: "at://<did>/app.bsky.feed.post/<rkey>" },
});
// build a complex algorithm
const hasNoBadContent = F.and(
F.isContentOk(0.9),
F.hasNoNSFWLabels,
F.isNotListMember("my-blocklist-url")
);
const algo = Algo.filter(
// the top level filter will combine elements in an "and" block
hasNoBadContent,
F.hasVideo,
F.or(
F.posterFollows("samuel.bsky.team"),
F.isListMember("my-whitelist-url"),
F.and(
F.regexMatches("text", "my-keyword-regex"),
F.regexMatches("embed.alt", "my-keyword-regex"),
F.regexMatches("embed.external.title", "my-keyword-regex"),
F.regexMatches("embed.external.description", "my-keyword-regex"),
F.isPost
),
F.or(
// nested logic blocks will be automatically flattened, so this will
// be brought up one level since it is logically equivalent.
F.regexNegationMatches("text", "my-negative-keyword-regex")
)
)
);
const manifest: FullForm = {
algorithm_manifest: algo,
id: 12,
user_id: 1,
display_name: "My Fancy Feed",
// file: add a file blob here to update the image
description: "This is a fancy feed with lots of logic for fun and profit.",
order: "new",
// CAUTION: this will change the feed slug and cause you to lose existing follows.
// but if you do it, don't worry you can set it back and it will be fixed : ).
record_name: "my-fancy-feed",
};
// send the algorithm to graze
const response = await graze.updateAlgorithm(manifest);
// publish the algorithm
const res = await graze.publishAlgorithm({ path: { feedId: 1234 } });
GrazeClientThis package is build with Effect. One feature of Effect is the ability to generate typesafe API clients with input/output validation. The GrazeClient is an Effect service for performing API requests. A benefit of using Effect is that errors will be typed in addition to success cases.
In the below example, the updateAlgo effect has the type: Effect.Effect<void, HttpApiDecodeError | HttpClientError | ParseError, GrazeClient>, meaning the success value is void, the possible errors are HttpApiDecodeError | HttpClientError | ParseError, and the effect requires a GrazeClient to run.
const updateAlgo = Effect.gen(function* () {
const client = yield* GrazeClient;
const res = yield* client.updateAlgorithm({
record_name: "my-feed",
display_name: "My Feed",
user_id: 1,
order: "new",
id: 1234,
algorithm_manifest: {
filter: {
and: [
{
regex_matches: ["text", /Hello World!/.source, true],
},
],
},
},
});
});
If you're interested, I recommend reading more in the Effect docs.
UpdateAlgorithmPayload schema.FAQs
A Typescript Graze API client.
The npm package graze-client receives a total of 18 weekly downloads. As such, graze-client popularity was classified as not popular.
We found that graze-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.