
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
placedocuments
Advanced tools
Lightweight helper around the DocuSign eSignature API that creates and sends an envelope from an array of document objects. It handles JWT authentication via the DocuSign SDK and returns the created envelopeId.
{ envelopeId } when the envelope is successfully created.sendDeclaration(documents: DeclarationDocument[], options: SendDeclarationOptions): Promise<{ envelopeId: string }>
options.recipients: { signerEmail, signerName, ccEmail, ccName }options.status: 'created' | 'sent' (defaults to 'created')options.tabs: anchor-based or coordinate-based placement. For anchors, set anchorString and offsets; for explicit coordinates, set xPosition, yPosition, and optional pageNumber.Each document you pass must include these fields:
documentBase64 — Base64-encoded file contentsname — Filename to show in DocuSignfileExtension — e.g., pdf, docxdocumentId — String identifier unique within the envelope (e.g., "1", "2")TypeScript interface used by the entry point:
export interface DeclarationDocument {
documentBase64: string;
name: string;
fileExtension: string;
documentId: string;
}
npm install placedocuments
Build (if working from source):
npm run build
import { sendDeclaration } from 'placedocuments';
const docs = [
{
documentBase64: 'BASE64_PDF_HERE',
name: 'My Document.pdf',
fileExtension: 'pdf',
documentId: '1',
},
];
const result = await sendDeclaration(docs, {
recipients: {
signerEmail: 'signer@example.com',
signerName: 'Signer Name',
ccEmail: 'cc@example.com',
ccName: 'CC Name',
},
});
console.log(result.envelopeId);
With recipients and explicit tab coordinates:
const result = await sendDeclaration(docs, {
recipients: {
signerEmail: 'signer@example.com',
signerName: 'Signer Name',
ccEmail: 'cc@example.com',
ccName: 'CC Name',
},
status: 'sent',
tabs: { xPosition: 100, yPosition: 150, pageNumber: 1 },
});
The library uses DocuSign JWT auth. By default, src/config.js reads some values from environment variables and falls back to config/appSettings.json (and a private key file path). You should prefer environment variables and avoid keeping real secrets in the repo.
Environment variables (template in .env.example):
DS_CLIENT_ID — DocuSign Integration Key (GUID)DS_IMPERSONATED_USER_GUID — GUID of the user being impersonatedDS_PRIVATE_KEY_PATH — Filesystem path to your RSA private key (PEM)DS_JWT_CLIENT_ID — Optional; often the same as DS_CLIENT_IDDS_SIGNER_EMAIL, DS_SIGNER_NAME, DS_CC_EMAIL, DS_CC_NAME — Optional recipient defaults (not recommended to hard-code)Notes:
.env automatically; set env vars in your process or have your app load them (e.g., dotenv) before using this package.options.recipients. Tab placement is optional and controlled via options.tabs (anchor-based by default, or explicit coordinates).sendDeclaration test mocks the envelope generator and does not hit the live DocuSign API.sendDeclaration and provides valid recipients and documents, and ensure your DocuSign JWT credentials are configured as described in Configuration.**signature_1**. If your documents don’t include this anchor, the signature field may not appear where expected.Changes in this version:
options.ISC
FAQs
places a document object array in a docusign envelope
The npm package placedocuments receives a total of 0 weekly downloads. As such, placedocuments popularity was classified as not popular.
We found that placedocuments demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.