
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
permify-javascript
Advanced tools
Permify is an open source authorization service for creating fine-grained and scalable authorization systems.
PermifyApi - JavaScript client for Permify REST Api Permify is an open source authorization service for creating fine-grained and scalable authorization systems. This SDK is automatically generated by the OpenAPI Generator project:
To publish the library as a npm, please follow the procedure in "Publishing npm packages".
Then install it via:
npm install permify-javascript --save
Finally, you need to build the module:
npm run build
To use the library locally without publishing to a remote npm registry, first install the dependencies by changing into the directory containing package.json (and this README). Let's call this JAVASCRIPT_CLIENT_DIR. Then run:
npm install
Next, link it globally in npm with the following, also from JAVASCRIPT_CLIENT_DIR:
npm link
To use the link you just defined in your project, switch to the directory you want to use your permify_api from, and run:
npm link /path/to/<JAVASCRIPT_CLIENT_DIR>
Finally, you need to build the module:
npm run build
If the library is hosted at a git repository, e.g.https://github.com/GIT_USER_ID/GIT_REPO_ID then install it via:
npm install GIT_USER_ID/GIT_REPO_ID --save
The library also works in the browser environment via npm and browserify. After following
the above steps with Node.js and installing browserify with npm install -g browserify,
perform the following (assuming main.js is your entry file):
browserify main.js > bundle.js
Then include bundle.js in the HTML pages.
Using Webpack you may encounter the following error: "Module not found: Error: Cannot resolve module", most certainly you should disable AMD loader. Add/merge the following section to your webpack config:
module: {
rules: [
{
parser: {
amd: false
}
}
]
}
Please follow the installation instruction and execute the following JS code:
var PermifyApi = require('permify-javascript');
var api = new PermifyApi.BundleApi()
var tenantId = "tenantId_example"; // {String} Identifier of the tenant, if you are not using multi-tenancy (have only one tenant) use pre-inserted tenant <code>t1</code> for this field. Required, and must match the pattern \\“[a-zA-Z0-9-,]+\\“, max 64 bytes.
var body = new PermifyApi.BundleDeleteBody(); // {BundleDeleteBody}
var callback = function(error, data, response) {
if (error) {
console.error(error);
} else {
console.log('API called successfully. Returned data: ' + data);
}
};
api.bundleDelete(tenantId, body, callback);
All URIs are relative to http://localhost
| Class | Method | HTTP request | Description |
|---|---|---|---|
| PermifyApi.BundleApi | bundleDelete | POST /v1/tenants/{tenant_id}/bundle/delete | delete bundle |
| PermifyApi.BundleApi | bundleRead | POST /v1/tenants/{tenant_id}/bundle/read | read bundle |
| PermifyApi.BundleApi | bundleWrite | POST /v1/tenants/{tenant_id}/bundle/write | write bundle |
| PermifyApi.DataApi | bundleRun | POST /v1/tenants/{tenant_id}/data/run-bundle | run bundle |
| PermifyApi.DataApi | dataAttributesRead | POST /v1/tenants/{tenant_id}/data/attributes/read | read attributes |
| PermifyApi.DataApi | dataDelete | POST /v1/tenants/{tenant_id}/data/delete | delete data |
| PermifyApi.DataApi | dataRelationshipsRead | POST /v1/tenants/{tenant_id}/data/relationships/read | read relationships |
| PermifyApi.DataApi | dataWrite | POST /v1/tenants/{tenant_id}/data/write | write data |
| PermifyApi.DataApi | relationshipsDelete | POST /v1/tenants/{tenant_id}/relationships/delete | delete relationships |
| PermifyApi.DataApi | relationshipsWrite | POST /v1/tenants/{tenant_id}/relationships/write | write relationships |
| PermifyApi.PermissionApi | permissionsCheck | POST /v1/tenants/{tenant_id}/permissions/check | check api |
| PermifyApi.PermissionApi | permissionsExpand | POST /v1/tenants/{tenant_id}/permissions/expand | expand api |
| PermifyApi.PermissionApi | permissionsLookupEntity | POST /v1/tenants/{tenant_id}/permissions/lookup-entity | lookup entity |
| PermifyApi.PermissionApi | permissionsLookupEntityStream | POST /v1/tenants/{tenant_id}/permissions/lookup-entity-stream | lookup entity stream |
| PermifyApi.PermissionApi | permissionsLookupSubject | POST /v1/tenants/{tenant_id}/permissions/lookup-subject | lookup-subject |
| PermifyApi.PermissionApi | permissionsSubjectPermission | POST /v1/tenants/{tenant_id}/permissions/subject-permission | subject permission |
| PermifyApi.SchemaApi | schemasList | POST /v1/tenants/{tenant_id}/schemas/list | list schema |
| PermifyApi.SchemaApi | schemasPartialWrite | PATCH /v1/tenants/{tenant_id}/schemas/partial-write | partially update your authorization model |
| PermifyApi.SchemaApi | schemasRead | POST /v1/tenants/{tenant_id}/schemas/read | read schema |
| PermifyApi.SchemaApi | schemasWrite | POST /v1/tenants/{tenant_id}/schemas/write | write schema |
| PermifyApi.TenancyApi | tenantsCreate | POST /v1/tenants/create | create tenant |
| PermifyApi.TenancyApi | tenantsDelete | DELETE /v1/tenants/{id} | delete tenant |
| PermifyApi.TenancyApi | tenantsList | POST /v1/tenants/list | list tenants |
| PermifyApi.WatchApi | watchWatch | POST /v1/tenants/{tenant_id}/watch | watch changes |
Authentication schemes defined for the API:
FAQs
Permify is an open source authorization service for creating fine-grained and scalable authorization systems.
We found that permify-javascript demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.