Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A comprehensive JavaScript/TypeScript library designed for both Node.JS and browsers, facilitating seamless interaction with the Atlassian Jira API.
Jira.js is a powerful Node.JS / Browser module that allows you to interact with the Jira Cloud API, Jira Agile Cloud API, Jira ServiceDesk Cloud API very easily.
Usability, consistency, and performance are key focuses of jira.js, and it also has nearly 100% coverage of the Jira API. It receives new Jira features shortly after they arrive in the API.
Node.js 18.0.0 or newer is required.
Install with the npm:
npm install jira.js
Install with the yarn:
yarn add jira.js
You can find the documentation here.
There are several types of authentication to gain access to the Jira API. Let's take a look at a few of them below:
Basic authentication allows you to log in with credentials. You can use username and password, but this login method is not supported in the online version and most standalone versions, so it's better to release API Token. Read how to do it here and use it together with email.
Username and password example:
import { Version3Client } from 'jira.js';
const client = new Version3Client({
host: 'https://your-domain.atlassian.net',
authentication: {
basic: {
username: 'YOUR_USERNAME',
password: 'YOUR_PASSWORD',
},
},
});
Email and API Token example:
import { Version3Client } from 'jira.js';
const client = new Version3Client({
host: 'https://your-domain.atlassian.net',
authentication: {
basic: {
email: 'YOUR@EMAIL.ORG',
apiToken: 'YOUR_API_TOKEN',
},
},
});
Only the authorization token is currently supported. To release it, you need to read the documentation and write your own code to get the token.
Example of usage
import { Version3Client } from 'jira.js';
const client = new Version3Client({
host: 'https://your-domain.atlassian.net',
authentication: {
oauth2: {
accessToken: 'YOUR_ACCESS_TOKEN',
},
},
});
To create a personal access token, use this link: https://id.atlassian.com/manage-profile/security/api-tokens
import { Version3Client } from 'jira.js';
const client = new Version3Client({
host: 'https://your-domain.atlassian.net',
authentication: {
personalAccessToken: 'secrectPAT',
},
});
Starting from version 4.0.0, the library has a new error handling system. Now, all errors are instances of
HttpException
class in case the Axios has response from the server;AxiosError
class in case something went wrong before sending the request.The HttpException
class tries to parse different sorts of responses from the server to provide a unified error class.
If the original error is required, you can get it from the cause
property of the HttpException
class.
try {
const users = await this.client.userSearch.findUsers({ query: email });
// ...
} catch (error: uknown) {
if (error instanceof HttpException) {
console.log(error.message);
console.log(error.cause); // original error (AxiosError | Error)
console.log(error.cause.response?.headers); // headers from the server
} else if (error instanceof AxiosError) {
console.log(error.message);
console.log(error.code); // error code, for instance AxiosError.ETIMEDOUT
} else {
console.log(error);
}
}
You can find out examples project here or perform the following actions:
host
, email
and apiToken
to your dataimport { Version3Client } from 'jira.js';
const client = new Version3Client({
host,
authentication: {
basic: {
email,
apiToken,
},
},
});
async function main() {
const { values: projects } = await client.projects.searchProjects();
if (projects.length) {
const project = projects[0];
const { id } = await client.issues.createIssue({
fields: {
summary: 'My first issue',
issuetype: {
name: 'Task'
},
project: {
key: project.key,
},
}
});
const issue = await client.issues.getIssue({ issueIdOrKey: id });
console.log(`Issue '${issue.fields.summary}' was successfully added to '${project.name}' project.`);
} else {
const myself = await client.myself.getCurrentUser();
const { id } = await client.projects.createProject({
key: 'PROJECT',
name: "My Project",
leadAccountId: myself.accountId,
projectTypeKey: 'software',
});
const project = await client.projects.getProject({ projectIdOrKey: id.toString() });
console.log(`Project '${project.name}' was successfully created.`);
}
}
main();
client.<group>.<methodName>(parametersObject);
Available groups:
The name of the methods is the name of the endpoint in the group without spaces and in camelCase
.
The parameters depend on the specific endpoint. For more information, see here.
If you use Webpack and need to reduce the size of the assembly, you can create your client with only the groups you use.
import { BaseClient } from 'jira.js';
import { Board } from 'jira.js/out/agile';
import { Groups } from 'jira.js/out/version2';
import { Issues } from 'jira.js/out/version3';
export class CustomJiraClient extends BaseClient {
board = new Board(this);
groups = new Groups(this);
issues = new Issues(this);
}
Distributed under the MIT License. See LICENSE
for more information.
FAQs
A comprehensive JavaScript/TypeScript library designed for both Node.JS and browsers, facilitating seamless interaction with the Atlassian Jira API.
We found that jira.js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.