
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
shein-open-sdk-js
Advanced tools
A comprehensive TypeScript SDK for SHEIN Open API integration, providing HTTP request utilities, data decryption methods, and flexible configuration management.
npm install shein-open-sdk-js
Or using yarn:
yarn add shein-open-sdk-js
Or using pnpm:
pnpm add shein-open-sdk-js
const { OpenRequest, decryptEventData, decryptResponse, decryptSecretKey, getByToken } = require('shein-open-sdk-js');
// Initialize with configuration object
const openRequest = new OpenRequest({
domain: "your-api-domain",
openKeyId: "your-open-key-id",
secretKey: "your-secret-key",
appid: "your-app-id",
appSecretKey: "your-app-secret-key",
});
// Make GET request with query parameters
const response = await openRequest.get('/api/endpoint', {
query: { page: 1, size: 10 }
});
console.log(response);
// Make POST request with body
const result = await openRequest.post('/api/endpoint', {
body: {
param1: "value1",
param2: "value2",
}
});
console.log(result);
// Use getByToken for authentication
const authResult = await getByToken(
{ domain: "your-api-domain" },
{ tempToken: "your-temp-token" }
);
console.log(authResult);
import { OpenRequest, OpenRequestConfig, getByToken, decryptEventData, decryptResponse, decryptSecretKey } from 'shein-open-sdk-js';
// Configuration interface
const config: OpenRequestConfig = {
domain: "your-api-domain",
openKeyId: "your-open-key-id",
secretKey: "your-secret-key",
appid: "your-app-id",
appSecretKey: "your-app-secret-key",
};
// API response interfaces
interface ApiResponse {
code: string;
msg?: string;
info?: {
data?: Array<{
id: number;
name: string;
}>;
total?: number;
};
}
const openRequest = new OpenRequest(config);
// Typed GET request
const response = await openRequest.get<ApiResponse>('/api/endpoint', {
query: { page: "1", size: "10" }
});
console.log(response.info?.data); // Type-safe access
// Typed POST request
const result = await openRequest.post('/api/endpoint', {
body: {
param1: "value1",
param2: "value2"
}
});
console.log(result);
// Data decryption
const decryptedData: string = decryptEventData("encrypted-data", "secret-key");
const decryptedResponse: string = decryptResponse("encrypted-response", "password");
const decryptedKey: string = decryptSecretKey("encrypted-key", "app-secret-key");
The SDK uses axios as the underlying HTTP client, providing:
You can customize the axios instance used by the SDK:
const client = new OpenRequest();
// Configure axios defaults
client.configureAxios({
timeout: 60000, // 60 seconds
headers: {
'User-Agent': 'MyApp/1.0.0'
}
});
// Or get direct access to the axios instance for advanced configuration
const axiosInstance = client.getAxiosInstance();
axiosInstance.interceptors.request.use(config => {
console.log('Making request to:', config.url);
return config;
});
new OpenRequest(config: OpenRequestConfig)
config: Configuration object containing API credentials and settingsget<T>(path, options?)Make a GET request.
async get<T = any>(
path: string,
options?: GetRequestOptions
): Promise<T>
Parameters:
path: API endpoint pathoptions (optional): Request options object
query: Query parameters as key-value pairsheaders: Custom HTTP headersExample:
const response = await openRequest.get('/api/endpoint', {
query: { page: 1, size: 10 },
headers: { 'Authorization': 'Bearer token' }
});
post<T>(path, options?)Make a POST request.
async post<T = any>(
path: string,
options?: PostRequestOptions
): Promise<T>
Parameters:
path: API endpoint pathoptions (optional): Request options object
body: Request body dataheaders: Custom HTTP headersquery: Query parameters as key-value pairsExample:
const response = await openRequest.post('/api/endpoint', {
body: {
param1: "value1",
param2: "value2"
},
headers: { 'Content-Type': 'application/json' }
});
getConfig()Get the current configuration.
getConfig(): OpenRequestConfig
Example:
const config = openRequest.getConfig();
console.log(config.domain); // "your-api-domain"
The OpenRequestConfig interface defines the structure for the configuration object:
interface OpenRequestConfig {
/** SHEIN开放平台域名 (必需) */
domain: string;
/** 您的开放密钥ID (可选,调用需要签名的接口时必需) */
openKeyId?: string;
/** 您的密钥 (可选,调用需要签名的接口时必需) */
secretKey?: string;
/** App ID (可选,调用需要签名的接口时必需) */
appid?: string;
/** App Secret Key (可选,用于解密响应数据) */
appSecretKey?: string;
}
The SDK includes methods for decrypting various types of encrypted data from SHEIN APIs:
decryptEventData(encryptedData, password)Decrypt encrypted event data.
const { decryptEventData } = require('shein-open-sdk-js');
const decryptedData = decryptEventData(encryptedEventData, password);
console.log(decryptedData);
decryptResponse(encryptedResponse, password)Decrypt encrypted API responses.
const { decryptResponse } = require('shein-open-sdk-js');
const decryptedResponse = decryptResponse(encryptedApiResponse, password);
console.log(decryptedResponse);
decryptSecretKey(encryptedKey, password)Decrypt encrypted secret keys from token exchange responses.
const { decryptSecretKey } = require('shein-open-sdk-js');
const decryptedKey = decryptSecretKey(encryptedSecretKey, password);
console.log(decryptedKey);
All HTTP requests return a standardized response format:
interface RequestResponse<T> {
data: T; // Response data (parsed JSON or raw text)
status: number; // HTTP status code
statusText: string; // HTTP status message
headers: Record<string, string>; // Response headers
}
Example:
const response = await client.get('/api/users');
console.log(response.status); // 200
console.log(response.statusText); // "OK"
console.log(response.data); // { users: [...] }
console.log(response.headers); // { "content-type": "application/json" }
The SDK provides comprehensive error handling with descriptive messages:
try {
const client = new OpenRequest('./missing-config.js');
} catch (error) {
console.error(error.message);
// "Configuration file not found. Please create a configuration file..."
}
try {
const response = await client.get('/api/invalid-endpoint');
} catch (error) {
console.error('Request failed:', error.message);
}
try {
const client = new OpenRequest('./invalid-config.js');
} catch (error) {
console.error(error.message);
// "Configuration must include a valid 'domain' field (string)"
}
const { OpenRequest, getByToken, decryptEventData, decryptResponse, decryptSecretKey } = require('shein-open-sdk-js');
async function example() {
try {
// Initialize client with configuration
const openRequest = new OpenRequest({
domain: "your-api-domain",
openKeyId: "your-open-key-id",
secretKey: "your-secret-key",
appid: "your-app-id",
appSecretKey: "your-app-secret-key",
});
// Get current configuration
const config = openRequest.getConfig();
console.log('Using API domain:', config.domain);
// Get data list
const dataList = await openRequest.get('/api/list', {
query: { page: 1, size: 10 }
});
console.log('Data list response:', dataList);
// Create or update data
const result = await openRequest.post('/api/data', {
body: {
name: "example",
type: "sample"
}
});
console.log('Operation result:', result);
// Use getByToken for authentication
const authResult = await getByToken(
{ domain: "your-api-domain" },
{ tempToken: "your-temp-token" }
);
console.log('Auth result:', authResult);
// Decrypt data examples
const decryptedData = decryptEventData("encrypted-event-data", "your-secret-key");
const decryptedResponse = decryptResponse("encrypted-response", "password");
const decryptedSecretKey = decryptSecretKey("encrypted-key", "your-app-secret-key");
} catch (error) {
console.error('API Error:', error.message);
}
}
example();
The SDK includes comprehensive TypeScript definitions:
// Configuration interface
interface OpenRequestConfig {
domain: string;
openKeyId?: string;
secretKey?: string;
appid?: string;
appSecretKey?: string;
}
// Request options interfaces
interface GetRequestOptions {
query?: Record<string, any>;
headers?: Record<string, any>;
}
interface PostRequestOptions {
body?: any;
headers?: Record<string, any>;
query?: Record<string, any>;
}
// getByToken interfaces
interface IGetByToken {
interface IRequestBody {
tempToken: string;
}
interface IResponseBody {
code: string;
msg?: string;
info?: {
secretKey: string;
openKeyId: string;
appid: string;
state?: string;
supplierId: number;
supplierSource: number;
supplierBusinessMode?: string;
};
traceId?: string;
}
}
This package provides multiple build formats:
lib/index.js - CommonJS bundle (default)lib/index.esm.js - ES Module bundlelib/index.umd.js - UMD bundle for browserslib/ - Individual CommonJS modules for tree-shakingWhile primarily designed for Node.js, the SDK can work in browser environments. However, note that:
Contributions are welcome! Please read our Contributing Guide for details.
This project is licensed under the MIT License - see the LICENSE file for details.
See CHANGELOG.md for a list of changes in each version.
FAQs
A TypeScript SDK for Shein API Tools
We found that shein-open-sdk-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.