
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
para-client-js
Advanced tools

Para was designed as a simple and modular backend framework for object persistence and retrieval. It helps you build applications faster by taking care of the backend. It works on three levels - objects are stored in a NoSQL data store or any old relational database, then automatically indexed by a search engine and finally, cached.
This is the JavaScript client for Para.
npm install para-client-js --save
Initialize the client in your code like so:
import { ParaClient } from 'para-client-js';
var pc = new ParaClient('ACCESS_KEY', 'SECRET_KEY');
If your code runs in a browser environment, you should use a blank secret key and then call signIn():
pc.signIn("password", "{email}::{password}", function(user) {
// do something with the newly created user
});
It's a bad idea to hardcode your Para secret key in your code because it will run in an insecure client-side environment. Instead use the signIn() method to get an access token (JWT) with limited client permissions. Think of it like this: API key+secret = full API access, paraClient.signIn() = limited API access for clients with JWT tokens.
You can have a special user object created just for your JS app and assign it special permissions so that your app can access a part of the Para API before authenticating another real user. Read the documentation for more information about client permissions.
For granting resource permissions to your client users go to console.paraio.org where you can edit your app object and allow your users the call specific API methods.
To use para-client-js in the browser run:
npm install
npm run build
This will generate dist/browser/para-client-js.global.iife.js which you can include directly in the browser:
<html>
<head>
<script src="dist/browser/para-client-js.global.iife.js"></script>
</head>
<body>
<script>
var ParaClient = require('para-client-js');
var pc = new ParaClient('ACCESS_KEY', 'SECRET_KEY');
</script>
</body>
</html>
npm run build bundles ESM, CommonJS, and browser artifacts into dist/ using tsdown. Types are emitted via npm run types.npm test runs ESLint followed by the fast unit tests in test/unit.test/integration and require a running Para server. Copy .env.example to .env, adjust PARA_* values, then run npm run test:integration.All methods return a promise object and also accept a callback function as last parameter. You can choose to either use callbacks or promises. For example:
// using promises
pc.read('user', '1234').then(
function (user) {
// do something with user object
},
function (err) {
// request failed
}
);
// using callbacks
pc.read('user', '1234', function (user, err) {
// do something with user object
});
git checkout -b my-new-feature)git commit -am 'Added a new feature')git push origin my-new-feature)For more information see CONTRIBUTING.md
FAQs
JavaScript Client for Para
The npm package para-client-js receives a total of 39 weekly downloads. As such, para-client-js popularity was classified as not popular.
We found that para-client-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.