Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
A client library for the IPFS API.
$ npm install --save ipfs-api
Note: ipfs-api requires Node v4.x (LTS) or higher.
To interact with the API, you need to have a local daemon running. It needs to be open on the right port. 5001
is the default, and is used in the examples below, but it can be set to whatever you need.
# Show the ipfs config API port to check it is correct
$ ipfs config Addresses.API
/ip4/127.0.0.1/tcp/5001
# Set it if it does not match the above output
$ ipfs config Addresses.API /ip4/127.0.0.1/tcp/5001
# Restart the daemon after changing the config
# Run the daemon
$ ipfs daemon
var ipfsAPI = require('ipfs-api')
// connect to ipfs daemon API server
var ipfs = ipfsAPI('localhost', '5001', {protocol: 'http'}) // leaving out the arguments will default to these values
// or connect with multiaddr
var ipfs = ipfsAPI('/ip4/127.0.0.1/tcp/5001')
// or using options
var ipfs = ipfsAPI({host: 'localhost', port: '5001', procotol: 'http'})
Same as in Node.js, you just have to browserify the code before serving it. See the browserify repo for how to do that.
<script>
tagYou can use npmcdn to get the latest built version, like this
<script src="https://npmcdn.com/ipfs-api/dist/index.js"></script>
This will export the IpfsApi
constructor on the window
object, such that:
var ipfs = window.IpfsApi('localhost', '5001')
If you omit the host and port, the api will parse window.host
, and use this information. This also works, and can be useful if you want to write apps that can be run from multiple different gateways:
var ipfs = window.IpfsApi()
If are using this module in a browser with something like browserify, then you will get an error saying that the origin is not allowed. This would be a CORS ("Cross Origin Resource Sharing") failure. The ipfs server rejects requests from unknown domains by default. You can whitelist the domain that you are calling from by changing your ipfs config like this:
$ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin "[\"http://example.com\"]"
See API.md and tests/api
for details on available methods.
If you do not pass in a callback all API functions will return a Promise
. For example:
ipfs.id()
.then(function (id) {
console.log('my id is: ', id)
})
.catch(function(err) {
console.log('Fail: ', err)
})
This relies on a global Promise
object. If you are in an environment where that is not
yet available you need to bring your own polyfill.
The js-ipfs API is a work in progress. As such, there's a few things you can do right now to help out:
MIT.
FAQs
A client library for the IPFS HTTP API
We found that ipfs-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.