
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
rebelsender
Advanced tools
The official Node.js SDK for RebelSender — high-velocity transactional email for builders.
fetch)npm install rebelsender
import { RebelSender } from 'rebelsender';
const rebel = new RebelSender('rs_live_your_api_key');
await rebel.send({
from: 'you@yourdomain.com',
to: 'user@gmail.com',
subject: 'Welcome aboard',
html: '<h1>You\'re in.</h1>',
});
const rebel = new RebelSender({
apiKey: 'rs_live_...',
baseUrl: 'https://api.rebelsender.com', // default
timeout: 30000, // 30s default
retries: 2, // retries on 5xx (GET only)
});
const { id, status } = await rebel.send({
from: 'alerts@yourdomain.com',
to: 'user@gmail.com',
subject: 'Your invoice is ready',
html: '<h1>Invoice #1234</h1><p>Amount: $99.00</p>',
tags: ['billing', 'invoice'],
});
await rebel.send({
from: 'noreply@yourdomain.com',
to: 'user@gmail.com',
templateId: 'tmpl_welcome',
templateData: { name: 'Jane', plan: 'Pro' },
});
const result = await rebel.emails.sendBatch([
{ from: 'you@co.com', to: 'a@gmail.com', subject: 'Hi A', html: '...' },
{ from: 'you@co.com', to: 'b@gmail.com', subject: 'Hi B', html: '...' },
]);
console.log(`${result.successful} sent, ${result.failed} failed`);
await rebel.send({
from: 'you@co.com',
to: 'user@gmail.com',
subject: 'Good morning!',
html: '<p>Rise and shine.</p>',
scheduledAt: new Date('2026-03-12T09:00:00Z'),
});
// List with filtering
const { data, pagination } = await rebel.emails.list({
status: 'DELIVERED',
limit: 50,
tag: 'billing',
});
// Get single email with event timeline
const email = await rebel.emails.get('email_id');
console.log(email.events); // [{ type: 'DELIVERED', timestamp: '...' }, ...]
// Cancel a scheduled email
await rebel.emails.cancel('email_id');
// Add a domain
const domain = await rebel.domains.create({ name: 'yourdomain.com' });
console.log(domain.dnsRecords); // DNS records to add
// Check verification
const verified = await rebel.domains.verify(domain.id);
// List all domains
const { data } = await rebel.domains.list();
// Create a webhook
const { data: webhook } = await rebel.webhooks.create({
url: 'https://yourapp.com/webhooks/email',
events: ['DELIVERED', 'BOUNCED', 'OPENED', 'CLICKED'],
});
console.log(webhook.secret); // Save this — shown only once
// List webhooks
const { data: webhooks } = await rebel.webhooks.list();
// Update
await rebel.webhooks.update(webhook.id, { active: false });
// Create
const template = await rebel.templates.create({
name: 'Welcome Email',
subject: 'Welcome, {{name}}!',
htmlBody: '<h1>Hey {{name}}</h1><p>Welcome to {{plan}}.</p>',
});
// Update
await rebel.templates.update(template.id, {
subject: 'Welcome aboard, {{name}}!',
});
// List & delete
const { data } = await rebel.templates.list();
await rebel.templates.delete(template.id);
// Suppress an address
await rebel.suppressions.add('bounced@example.com');
// Bulk suppress
await rebel.suppressions.addBulk(['a@test.com', 'b@test.com']);
// Check before sending
const { suppressed } = await rebel.suppressions.check('user@gmail.com');
// Remove suppression
await rebel.suppressions.remove('user@gmail.com');
const stats = await rebel.analytics.overview();
// { sent: 12400, delivered: 12380, openRate: 0.42, clickRate: 0.12, ... }
const { data: timeseries } = await rebel.analytics.timeseries({
from: '2026-03-01',
to: '2026-03-11',
});
The SDK throws typed errors you can catch and handle:
import {
RebelSenderError,
AuthenticationError,
ValidationError,
RateLimitError,
NotFoundError,
} from 'rebelsender';
try {
await rebel.send({ from: 'bad', to: '', subject: '' });
} catch (err) {
if (err instanceof ValidationError) {
console.log('Invalid params:', err.details);
} else if (err instanceof AuthenticationError) {
console.log('Bad API key');
} else if (err instanceof RateLimitError) {
console.log(`Retry after ${err.retryAfter}s`);
} else if (err instanceof NotFoundError) {
console.log('Resource not found');
} else if (err instanceof RebelSenderError) {
console.log(`API error ${err.status}: ${err.message}`);
}
}
// Create a new API key
const key = await rebel.apiKeys.create({ name: 'Production' });
console.log(key.key); // Full key — shown only once
// List keys
const { data } = await rebel.apiKeys.list();
// Revoke
await rebel.apiKeys.revoke(key.id);
fetch)MIT
FAQs
Official Node.js SDK for RebelSender — high-velocity email for builders
We found that rebelsender demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.