
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
node-onedrive-unofficial
Advanced tools
node-onedrive-unofficial is a limited OneDrive client using the new OneDrive API.
What works:
What doesn't work yet:
Install Node.js (includes npm)
Note to Windows users installing Node.js for the first time: You may need to sign out of your Windows account for your PATH changes to take effect.
Install node-onedrive-unofficial using npm
npm -g install node-onedrive-unofficial
Get a one-time sign-in code for your Microsoft account here: https://seattle.gregedmiston.com/scratch/onedrive-auth
Want to use your own app ID and sign-in page for redistribution? See "Advanced authentication" section near the bottom.
Redeem your sign-in code using onedrive.js
If you installed globally using npm -g, then run:
onedrive signin YOURCODEHERE
If you installed the package locally or don't have your PATH configured for npm, you can run it locally:
node ./node-modules/node-onedrive-unofficial/onedrive.js signin YOURCODEHERE
Try it out using the command line first.
For help:
onedrive --help
Get a folder listing of your OneDrive:
onedrive api /drive/root/children
###Using the command line
Upload ./localfolder/foo.txt to /destination.txt
onedrive put ./localfolder/foo.txt /destination.txt
Get a folder listing of your OneDrive:
onedrive api /drive/root/children
Delete file /filetodelete.txt
onedrive api --method=DELETE /drive/root:/filetodelete.txt
Rename /oldname.txt to /newname.txt:
onedrive api --method=PATCH /drive/root:/oldname.txt --body='{"name": "newname.txt"}
See the full list of OneDrive APIs.
Include the package
var onedrive = require('node-onedrive-unofficial');
var account = null; // use built-in easy authentication
The examples below use the built-in app ID. These assume that you have already signed in using the command line signin command described in Getting started.
Upload ./localfolder/foo.txt to /destination.txt
onedrive.put( account, './localfolder/foo.txt', '/destination.txt', function(uploadedItem, err) {
if (!err) {
// do something with uploadedItem
}
});
Get a folder listing of your OneDrive:
onedrive.api( account, {
path: '/drive/root/children'
}, function(folderListing, err) {
if (!err) {
// do something with folderListing
}
});
Rename /oldname.txt to /newname.txt
onedrive.api( account, {
path: '/drive/root:/oldname.txt',
method: 'PATCH',
body: {"name": "newname.txt"}
}, function(response, err) {
if (!err) {
// success
}
});
Delete file /filetodelete.txt
onedrive.api( account, {
path: '/drive/root:/filetodelete.txt',
method: 'DELETE'
}, function(response, err) {
if (!err) {
// success
}
});
There are 2 options for developer IDs:
microsoft-developer-config.json file in the npm package.
null for the first argument will use the default developer config.clientId, clientSecret, and redirectUri in a JSON object.--config=myDevConfig.json during any call.There are 2 options for storing user tokens:
.microsoft-user-tokens.json in your user's home folder. By default, tokens are automatically read from this path and written with updated tokens.
null for the first argument will use the default token storage.--token myTokenFile.json with every call.lastAuthTokens section to the config. With every response, you will get an updated token.FAQs
An unofficial node.js client for OneDrive
We found that node-onedrive-unofficial demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.