
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The new all-in-one Pinata SDK
View the full documentation here
npm i pinata
Import and initialize the SDK in your codebase with the following variables
import { PinataSDK } from "pinata";
const pinata = new PinataSDK({
pinataJwt: "PINATA_JWT",
pinataGateway: "example-gateway.mypinata.cloud",
});
The PINATA_JWT is a secret key, be sure to initialize the SDK in a secure environment and practice basic variable security practices. If you need to upload from a client environment, consider using signed JWTs
import { PinataSDK } from "pinata";
const pinata = new PinataSDK({
pinataJwt: process.env.PINATA_JWT!,
pinataGateway: "example-gateway.mypinata.cloud",
});
async function main() {
try {
const file = new File(["hello"], "Testing.txt", { type: "text/plain" });
const upload = await pinata.upload.public.file(file);
console.log(upload);
} catch (error) {
console.log(error);
}
}
await main();
This will return an object like the following:
{
id: "0195a5c4-242f-7c01-bee8-f34a9e8e804b",
user_id: "87ef31fe-519b-4ffe-90d9-987771247827",
group_id: null,
name: "hello.txt",
cid: "bafkreid7qoywk77r7rj3slobqfekdvs57qwuwh5d2z3sqsw52iabe3mqne",
created_at: "2025-03-17T20:20:50.057Z",
size: 12,
number_of_files: 1,
mime_type: "text/plain",
vectorized: false,
network: "public",
}
Use the cid or from the upload to fetch a file
import { PinataSDK } from "pinata";
const pinata = new PinataSDK({
pinataJwt: process.env.PINATA_JWT!,
pinataGateway: "example-gateway.mypinata.cloud",
});
async function main() {
try {
const data = await pinata.gateways.public.get("bafkreibm6jg3ux5qumhcn2b3flc3tyu6dmlb4xa7u5bf44yegnrjhc4yeq");
console.log(data)
} catch (error) {
console.log(error);
}
}
main();
View the full documentation here
git clone https://github.com/PinataCloud/pinata
cd pinata
npm install
Run Build
npm run build
Run Tests
npm run test
FAQs
The official Pinata SDK
The npm package pinata receives a total of 11,760 weekly downloads. As such, pinata popularity was classified as popular.
We found that pinata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.