
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
sp-jsom-node
Advanced tools
sp-jsom-node provides a feasibility of using JSOM (CSOM, SharePoint Client Object Model) in Node.js.
sp-jsom-node patches global variables and request client which let's JSOM used to behave as if it were in it's usual environment - a browser's SharePoint page.
core - core JSOM module (loaded by default at first place)search - sp.search.jspublishing - sp.publishing.jstaxonomy - sp.taxonomy.jsuserprofiles - sp.userprofiles.jsdocumentmanagement - sp.documentmanagement.jsworkmanagement - sp.workmanagement.jspolicy - sp.policy.jsproject - PS.js (Project Server API)SharePoint On-Premise (2019, 2016, 2013):
SharePoint Online:
npm install sp-jsom-node --save

import { JsomNode, IConfigSettings } from 'sp-jsom-node';
export const setting: IConfigSettings = {
configPath: './config/private.json'
}; // Optional setting, by default ./config/private.json is used
new JsomNode().wizard(setting).then((siteUrl) => {
/// ... <<< JSOM can be used here
const ctx = new SP.ClientContext(siteUrl);
}).catch(console.log);
First wizard run propmts for SharePoint site url and credentials strategy parameters.
const JsomNode = require('sp-jsom-node').JsomNode;
new JsomNode().wizard().then((siteUrl) => {
/// ... <<< JSOM can be used here
const ctx = new SP.ClientContext(siteUrl);
}).catch(console.log);
import { JsomNode, IJsomNodeContext } from 'sp-jsom-node';
const authOptions: any = require('./config/private.json');
const authContext: IJsomNodeContext = {
siteUrl: authOptions.siteUrl,
authOptions
};
const ctx = new JsomNode().init(authContext).getContext();
/// ... <<< JSOM can be used here
// const ctx = SP.ClientContext.get_current(); // works with single environment
const oWeb = ctx.get_web();
const oLists = oWeb.get_lists();
const listCreationInfo = new SP.ListCreationInformation();
listCreationInfo.set_title('New Lists');
listCreationInfo.set_templateType(100);
const oList = oLists.add(listCreationInfo);
ctx.load(oList);
ctx.executeQueryAsync(() => {
console.log(oList);
}, (sender, args) => {
console.log(args.get_message());
});
Client context runtime is extended with executeQueryPromise - promisified version of executeQueryAsync. Which allows coding with async/await in a "synchronous" handy style, having elegant and easily maintainable code.
import { JsomNode, IJsomNodeContext } from 'sp-jsom-node';
const authOptions: any = require('./config/private.json');
const authContext: IJsomNodeContext = {
siteUrl: authOptions.siteUrl,
authOptions
};
(async () => {
const clientContex = new JsomNode().init(authOptions).getContext();
// const clientContex = SP.ClientContext.get_current();
const oListsCollection = clientContext.get_web().get_lists();
clientContext.load(oListsCollection, 'Include(Title)');
await clientContext.executeQueryPromise(); // Using JSOM extension
const listsTitlesArr = oListsCollection.get_data()
.map((l) => l.get_title());
console.log('Lists', listsTitlesArr);
})()
.catch(console.error);
By default, only core modules are loaded.
Additional CSOM features can be requested in modules setting.
import { JsomNode, IJsomNodeSettings } from 'sp-jsom-node';
// ...authOptions
const settings: any = require('./config/private.json');
const jsomSettings: IJsomNodeSettings = {
modules: [ 'taxonomy', 'userprofiles' ],
envCode: '2013' // 'spo' is default
};
new JsomNode(jsomSettings).init(authOptions);
/// ... <<< JSOM can be used here
import { JsomNode, IJsomNodeSettings } from 'sp-jsom-node';
// ...authOptions
const settings: any = require('./config/private.json');
const jsomSettings: IJsomNodeSettings = {
modules: [ 'project' ]
};
new JsomNode(jsomNodeOptions).init(authOptions);
(async () => {
// API Reference - https://msdn.microsoft.com/en-us/library/office/jj669820.aspx
const projCtx = PS.ProjectContext.get_current();
const projects = projCtx.get_projects();
projCtx.load(projects, 'Include(Name, Id)');
await projCtx.executeQueryPromise();
console.log(projects.get_data().map(p => p.get_name()));
})()
.catch(console.error);
modules?: JsomModules[]; // On demand modules load | Default is ['core']envCode?: 'spo' | '2019' | '2016' | '2013'; // Loads different version of JSOM javascripts | Default is 'spo'.init(context: IJsomNodeContext)siteUrl: string; // Optional SPWeb urlauthOptions: IAuthOptions; node-sp-auth credentials options.wizard(config?: IConfigSettings)node-sp-auth-config options
configPath?: string; // Path to auth config .json | Default is './config/private.json'encryptPassword?: boolean; // Encrypts password to a machine-bind hash | Default is 'true'saveConfigOnDisk?: boolean; // Saves config .json to disk | Default is 'true'Settings can be left blank. Auth options in such a case will be asked by node-sp-auth-config options in a wizard like approach.
authOptions:
node-sp-auth formatnpm run test

When creating automation scripts for production environment, e.g. Azure Job or Function or embedded application like Electron, it can be important to bundle and minify sources with positive performant effect as a result. Check example with bundling.
This project was mostly inspired by Vadim Gremyachev's project - CSOMNode, but implements JSOM in node in a bit different way, in TypeScript and supports different auth scenarious implemented in node-sp-auth by Sergei Sergeev.
FAQs
SharePoint JavaScript Object Model for Node.js
We found that sp-jsom-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.