
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
libnpmorg is a Node.js library for
programmatically accessing the npm Org membership
API.
const org = require('libnpmorg')
console.log(await org.ls('myorg', {token: 'deadbeef'}))
=>
Roster {
zkat: 'developer',
iarna: 'admin',
isaacs: 'owner'
}
$ npm install libnpmorg
opts for libnpmorg commandslibnpmorg uses npm-registry-fetch.
All options are passed through directly to that library, so please refer to its
own opts
documentation
for options that can be passed in.
A couple of options of note for those in a hurry:
opts.token - can be passed in and will be used as the authentication token for the registry. For other ways to pass in auth details, see the n-r-f docs.opts.otp - certain operations will require an OTP token to be passed in. If a libnpmorg command fails with err.code === EOTP, please retry the request with {otp: <2fa token>}> org.set(org, user, [role], [opts]) -> PromiseThe returned Promise resolves to a Membership Detail object.
The role is optional and should be one of admin, owner, or developer.
developer is the default if no role is provided.
org and user must be scope names for the org name and user name
respectively. They can optionally be prefixed with @.
See also: PUT /-/org/:scope/user
await org.set('@myorg', '@myuser', 'admin', {token: 'deadbeef'})
=>
MembershipDetail {
org: {
name: 'myorg',
size: 15
},
user: 'myuser',
role: 'admin'
}
> org.rm(org, user, [opts]) -> PromiseThe Promise resolves to null on success.
org and user must be scope names for the org name and user name
respectively. They can optionally be prefixed with @.
See also: DELETE /-/org/:scope/user
await org.rm('myorg', 'myuser', {token: 'deadbeef'})
> org.ls(org, [opts]) -> PromiseThe Promise resolves to a Roster object.
org must be a scope name for an org, and can be optionally prefixed with @.
See also: GET /-/org/:scope/user
await org.ls('myorg', {token: 'deadbeef'})
=>
Roster {
zkat: 'developer',
iarna: 'admin',
isaacs: 'owner'
}
> org.ls.stream(org, [opts]) -> StreamReturns a stream of entries for a
Roster,
with each emitted entry in [key, value] format.
org must be a scope name for an org, and can be optionally prefixed with @.
The returned stream is a valid Symbol.asyncIterator.
See also: GET /-/org/:scope/user
for await (let [user, role] of org.ls.stream('myorg', {token: 'deadbeef'})) {
console.log(`user: ${user} (${role})`)
}
=>
user: zkat (developer)
user: iarna (admin)
user: isaacs (owner)
The npm package itself provides some CLI commands to manage organizations, such as `npm org add` and `npm org rm`. However, it is more focused on package management and lacks the programmatic API that libnpmorg offers.
The np package is a tool for publishing npm packages with ease. While it provides some utilities for managing npm packages, it does not offer specific functionalities for managing npm organizations like libnpmorg does.
The npm-cli package provides a command-line interface for interacting with npm. It includes commands for managing organizations, but it does not offer the same level of programmatic control as libnpmorg.
FAQs
Programmatic api for `npm org` commands
The npm package libnpmorg receives a total of 302,755 weekly downloads. As such, libnpmorg popularity was classified as popular.
We found that libnpmorg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.