
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
shopify-shepherd
Advanced tools

unofficial shopify frontend js sdk
shopify-shepherd helps you build a clientside ecommerce experience
♻️ replaces the official shopify-buy sdk
🐏 powers sheep-cart store ui
🛡️ fully typed, and written in typescript
🗿 zero dependencies
🤝 extensible and open to pull requests
💖 free and open source
📦 npm i shopify-shepherd
but why not just use shopify's official sdk?
it's poorly maintained, semi-abandoned, and missing features that i need for building sheep-cart.
📦 install shopify-shepherd
npm i shopify-shepherd
🔑 setup with your shopify credentials
import {Shopify} from "shopify-shepherd"
const shopify = Shopify.setup({
domain: "dev-bakery.myshopify.com",
storefront_access_token: "5f636be6b04aeb2a7b96fe9306386f25",
})
📥 fetch basically everything in your store
const {
shop,
products,
collections,
} = await shopify.fetch_everything()
const everything = await shopify.fetch_everything()
const shop = await shopify.shop()
const products = await Shopify.all(shopify.products())
const collections = await Shopify.all(shopify.collections())
const tags = await Shopify.all(shopify.tags())
const product = await shopify.product({
id: "gid://shopify/Product/6606267416654",
})
for await (const [page] of shopify.products())
console.log("page of products", page)
for await (const [page] of shopify.collections())
console.log("page of collections", page)
const products = await Shopify.all(shopify.products_in_collection({
collection_id: "gid://shopify/Collection/270755627086",
}))
const products = await Shopify.all(shopify.products({
query: {
// products must have both of these terms in the title
terms: ["crunchy", "pakora"],
// products must have both of these tags
tags: ["appetizer", "indian"],
},
}))
const product = await shopify.specific_products({
ids: [
"gid://shopify/Product/6606267416654",
"gid://shopify/Product/10232153543",
],
})
const products = await shopify.product_recommendations({
product_id: "gid://shopify/Product/6606268268622",
})
const {web_url} = await shopify.checkout({
line_items: {
variant_id: "gid://shopify/ProductVariant/39382832709710",
quantity: 1,
},
})
🤔 understanding shopify's pagination model
🗐 shepherd presents pagination with javascript async generators
for await (const [page] of shopify.products())
console.log("page of products", page)
for await (const [page] of shopify.collections())
console.log("page of collections", page)
for (await const [page] of shopify.products({page_size: 250}))
console.log(page)
🪄 fetch every page with the Shopify.all helper
const products = await Shopify.all(shopify.products())
const collections = await Shopify.all(shopify.collections())
🔂 fetch only the first page with the Shopify.first helper
const products = await Shopify.first(shopify.products())
📥 fetch your shop info
const shop = await shopify.shop()
console.log(shop.shipsToCountries)
//⮞ ["CA", "US", "MX", "XX"]
⏳ separately import shepherd's CountryLibrary
import {CountryLibrary} from "shopify-shepherd/x/countries.js"
15 K💅 use the country library to show pretty names to users
const countries = new CountryLibrary().query_names(shop.shipsToCountries)
console.log("countries we ship to: " + countries.join(", "))
//⮞ countries we ship to: Canada, United States of America, Mexico, XX
query_namesFAQs
unofficial shopify sdk for frontend websites
The npm package shopify-shepherd receives a total of 0 weekly downloads. As such, shopify-shepherd popularity was classified as not popular.
We found that shopify-shepherd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.