
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
node-addon-api
Advanced tools
The node-addon-api package is a helper library for building Node.js Addons in C++. It provides a C++ API that abstracts away the complexities of working with the low-level V8 and N-API provided by Node.js, making it easier to develop native addons.
Object Wrapping
Object wrapping allows C++ classes to be represented as JavaScript objects. It provides an easy way to create and manage objects that have a one-to-one relationship with C++ objects.
Napi::ObjectReference MyClass::constructor;
MyClass::MyClass(const Napi::CallbackInfo& info) : Napi::ObjectWrap<MyClass>(info) {
// constructor implementation
}
Napi::Object MyClass::Init(Napi::Env env, Napi::Object exports) {
Napi::HandleScope scope(env);
Napi::Function func = DefineClass(env, "MyClass", {
InstanceMethod("myMethod", &MyClass::MyMethod)
});
constructor = Napi::Persistent(func);
constructor.SuppressDestruct();
exports.Set("MyClass", func);
return exports;
}
Function Arguments
The package provides a way to handle function arguments passed from JavaScript to C++ with type checking and conversion utilities.
Napi::Value MyFunction(const Napi::CallbackInfo& info) {
Napi::Env env = info.Env();
if (info.Length() < 2) {
Napi::TypeError::New(env, "Expected at least two arguments").ThrowAsJavaScriptException();
}
Napi::String arg0 = info[0].As<Napi::String>();
double arg1 = info[1].As<Napi::Number>().DoubleValue();
// function implementation
return Napi::String::New(env, "result");
}
Asynchronous Operations
node-addon-api provides utilities for performing asynchronous operations, allowing long-running tasks to be executed without blocking the Node.js event loop.
class MyAsyncWorker : public Napi::AsyncWorker {
public:
MyAsyncWorker(Napi::Function& callback) : AsyncWorker(callback) {}
void Execute() override {
// Do work in another thread
}
void OnOK() override {
Napi::HandleScope scope(Env());
Callback().Call({Env().Null(), Napi::String::New(Env(), "Success")});
}
};
Napi::Value RunAsyncWork(const Napi::CallbackInfo& info) {
Napi::Function callback = info[0].As<Napi::Function>();
MyAsyncWorker* worker = new MyAsyncWorker(callback);
worker->Queue();
return info.Env().Undefined();
}
The 'nan' package is a header file filled with macros and utilities for making addon development for different versions of V8 easier. It predates N-API and node-addon-api, and while it's still used, node-addon-api is recommended for most cases due to its simpler API and direct support for N-API.
The 'ffi-napi' package allows for calling foreign functions of dynamic libraries from Node.js. It is similar to node-addon-api in that it allows for native functionality in Node.js, but it focuses on interfacing with existing libraries rather than writing new native modules.
The 'neon' package is a Rust framework for writing safe and fast native Node.js modules. Like node-addon-api, it simplifies the process of writing native addons but does so using Rust instead of C++.
NOTE: The default branch has been renamed! master is now named main
If you have a local clone, you can update it by running:
git branch -m master main
git fetch origin
git branch -u origin/main main
This module contains header-only C++ wrapper classes which simplify the use of the C based Node-API provided by Node.js when using C++. It provides a C++ object model and exception handling semantics with low overhead.
There are three options for implementing addons: Node-API, nan, or direct use of internal V8, libuv, and Node.js libraries. Unless there is a need for direct access to functionality that is not exposed by Node-API as outlined in C/C++ addons in Node.js core, use Node-API. Refer to C/C++ addons with Node-API for more information on Node-API.
Node-API is an ABI stable C interface provided by Node.js for building native addons. It is independent of the underlying JavaScript runtime (e.g. V8 or ChakraCore) and is maintained as part of Node.js itself. It is intended to insulate native addons from changes in the underlying JavaScript engine and allow modules compiled for one version to run on later versions of Node.js without recompilation.
The node-addon-api
module, which is not part of Node.js, preserves the benefits
of the Node-API as it consists only of inline code that depends only on the stable API
provided by Node-API. As such, modules built against one version of Node.js
using node-addon-api should run without having to be rebuilt with newer versions
of Node.js.
It is important to remember that other Node.js interfaces such as
libuv
(included in a project via #include <uv.h>
) are not ABI-stable across
Node.js major versions. Thus, an addon must use Node-API and/or node-addon-api
exclusively and build against a version of Node.js that includes an
implementation of Node-API (meaning an active LTS version of Node.js) in
order to benefit from ABI stability across Node.js major versions. Node.js
provides an ABI stability guide containing a detailed explanation of ABI
stability in general, and the Node-API ABI stability guarantee in particular.
As new APIs are added to Node-API, node-addon-api must be updated to provide wrappers for those new APIs. For this reason, node-addon-api provides methods that allow callers to obtain the underlying Node-API handles so direct calls to Node-API and the use of the objects/methods provided by node-addon-api can be used together. For example, in order to be able to use an API for which the node-addon-api does not yet provide a wrapper.
APIs exposed by node-addon-api are generally used to create and manipulate JavaScript values. Concepts and operations generally map to ideas specified in the ECMA262 Language Specification.
The Node-API Resource offers an excellent orientation and tips for developers just getting started with Node-API and node-addon-api.
(See CHANGELOG.md for complete Changelog)
node-addon-api is based on Node-API and supports using different Node-API versions. This allows addons built with it to run with Node.js versions which support the targeted Node-API version. However the node-addon-api support model is to support only the active LTS Node.js versions. This means that every year there will be a new major which drops support for the Node.js LTS version which has gone out of service.
The oldest Node.js version supported by the current version of node-addon-api is Node.js 14.x.
The following is the documentation for node-addon-api.
Are you new to node-addon-api? Take a look at our examples
To run the node-addon-api tests do:
npm install
npm test
To avoid testing the deprecated portions of the API run
npm install
npm test --disable-deprecated
To run the tests targeting a specific version of Node-API run
npm install
export NAPI_VERSION=X
npm test --NAPI_VERSION=X
where X is the version of Node-API you want to target.
To run a specific unit test, filter conditions are available
Example: compile and run only tests on objectwrap.cc and objectwrap.js
npm run unit --filter=objectwrap
Multiple unit tests cane be selected with wildcards
Example: compile and run all test files ending with "reference" -> function_reference.cc, object_reference.cc, reference.cc
npm run unit --filter=*reference
Multiple filter conditions can be joined to broaden the test selection
Example: compile and run all tests under folders threadsafe_function and typed_threadsafe_function and also the objectwrap.cc file npm run unit --filter='*function objectwrap'
To run the node-addon-api tests with --debug
option:
npm run-script dev
If you want a faster build, you might use the following option:
npm run-script dev:incremental
Take a look and get inspired by our test suite
You can run the available benchmarks using the following command:
npm run-script benchmark
See benchmark/README.md for more details about running and adding benchmarks.
As node-addon-api's core mission is to expose the plain C Node-API as C++
wrappers, tools that facilitate n-api/node-addon-api providing more
convenient patterns for developing a Node.js add-on with n-api/node-addon-api
can be published to NPM as standalone packages. It is also recommended to tag
such packages with node-addon-api
to provide more visibility to the community.
Quick links to NPM searches: keywords:node-addon-api.
Rust
)The use of badges is recommended to indicate the minimum version of Node-API required for the module. This helps to determine which Node.js major versions are supported. Addon maintainers can consult the Node-API support matrix to determine which Node.js versions provide a given Node-API version. The following badges are available:
We love contributions from the community to node-addon-api! See CONTRIBUTING.md for more details on our philosophy around extending this module.
Name | GitHub Link |
---|---|
Anna Henningsen | addaleax |
Chengzhong Wu | legendecas |
Jack Xia | JckXia |
Kevin Eady | KevinEady |
Michael Dawson | mhdawson |
Nicola Del Gobbo | NickNaso |
Vladimir Morozov | vmoroz |
Name | GitHub Link |
---|---|
Arunesh Chandra | aruneshchandra |
Benjamin Byholm | kkoopa |
Gabriel Schulhof | gabrielschulhof |
Hitesh Kanwathirtha | digitalinfinity |
Jason Ginchereau | jasongin |
Jim Schlight | jschlight |
Sampson Gao | sampsongao |
Taylor Woll | boingoing |
Licensed under MIT
2023-04-20 Version 6.1.0, @NickNaso
Napi::Value::As()
.Napi::TypeTaggable
class.NAPI_HAS_THREADS
to make TSFN available on Emscripten.NODE_API_NO_EXTERNAL_BUFFERS_ALLOWED
and
Napi::Buffer::NewOrCopy()
to handle the support for external buffers.Napi::Reference<T>
class.Napi::RangeError
and Napi::TypeError
class.Napi::ObjectReference<T>
class.Napi::ObjectWrap<T>
class.Napi::TypeTaggable
.5adb896782
] - src: enforce type checks on Napi::Value::As() (#1281) (Chengzhong Wu)d9faac7ec2
] - Fix exits/exists typo in docs for Env::AddCleanupHook() (#1306) (Mathias Stearn)164459ca03
] - doc: update class hierarchy for TypeTaggable (Gabriel Schulhof) #1303d01304437c
] - src: interject class TypeTaggable (Gabriel Schulhof) #1298d4942ccd4f
] - test: Complete test coverage for Reference<T> class (#1277) (Jack)a8ad7e7a7b
] - test: Add tests for copy/move semantics (JckXia) #1295e484327344
] - Add test coverage for typed and range err (#1280) (Jack)ebc7858593
] - test: Update wait with a condition (#1297) (Jack)0b53d885f5
] - src: define NAPI_HAS_THREADS
(toyobayashi) #1283464610babf
] - test: complete objectRefs tests (JckXia) #1274b16c762a19
] - src: handle no support for external buffers (legendecas) #127361b8e28720
] - test: Add test covg for obj wrap (#1269) (Jack)FAQs
Node.js API (Node-API)
The npm package node-addon-api receives a total of 23,870,829 weekly downloads. As such, node-addon-api popularity was classified as popular.
We found that node-addon-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.