
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Nubli is a Node.JS library for Nuki Smart Locks (Nuki Bluetooth Library) Nubli is very energy efficient when used properly and should't drain more power than a Nuki bridge. It uses the same protocol the App and Bridge uses and therefore communicates securely with the Smart Lock.
Note: Do not use the built-in Bluetooth in a Raspberry Pi. Due to bad hardware design it will not reliably connect to your Smart Lock and cause unexpected disconnects. I've been there and invested a whole week into fixing it.
const nubli = require('nubli').default;
nubli.onReadyToScan()
.then(() => {
nubli.startScanning();
})
.catch((err) => {
console.log(err);
});
nubli.startScanning(): void;
nubli.startActiveScanning(): void;
Notes:
nubli.readyToScan() to resolve first. nubli.stopScanning(): void;
smartlock.connect(): Promise<void>;
smartlock.disconnect(): Promise<void>;
smartlock.configExists(path?: string): boolean;
smartlock.readConfig(path?: string): Promise<void>;
smartlock.saveConfig(path?: string): Promise<void>;
smartlock.pair(asBridge = true): Promise<void>;
Note: By default it will pair as bridge. If you do have a bridge, make sure to pass false as a parameter. The reason is, that when no bridge exists, Nuki will not push any state changes automatically via advertisements, so we set ourselves as a bridge instead.
smartlock.readLockState(): Promise<SmartLockResponse>;
smartlock.unlock(updateCallback?: (response: SmartLockResponse) => void): Promise<SmartLockResponse>;
smartlock.lock(updateCallback?: (response: SmartLockResponse) => void): Promise<SmartLockResponse>;
smartlock.unlatch(updateCallback?: (response: SmartLockResponse) => void): Promise<SmartLockResponse>;
smartlock.lockNGo(updateCallback?: (response: SmartLockResponse) => void): Promise<SmartLockResponse>;
smartlock.lockNGoUnlatch(updateCallback?: (response: SmartLockResponse) => void): Promise<SmartLockResponse>;
smartlock.requestConfig(): Promise<SmartLockResponse>;
smartlock.requestAdvancedConfig(): Promise<SmartLockResponse>;
smartlock.paired: boolean;
nubli.on('smartLockDiscovered', (smartlock: SmartLock) => void);
nubli.on('startedScanning', () => void);
nubli.on('stoppedScanning', () => void);
smartlock.on('connected', () => void);
smartlock.on('disconnected', () => void);
smartlock.on('error', (err: string) => void);
smartlock.on('activityLogChanged', () => void);
Note: The activityLogChanged event only works while scanning because the Smart Lock advertises activity log changes via bluetooth. To get notified when the door opens or closes (Door Sensor) make sure to enable 'Log door sensor status' in the Nuki app.
If you have any questions or help please open an issue on the GitHub project page.
Pull requests are always welcome. If you have an issue or feature request please open a GitHub issue.
The project is subject to the MIT license unless otherwise noted. A copy can be found in the root directory of the project LICENSE.
FAQs
Nuki Bluetooth Library
The npm package nubli receives a total of 2 weekly downloads. As such, nubli popularity was classified as not popular.
We found that nubli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.