
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
sp-pnp-node
Advanced tools
SharePoint JavaScript Core Library (PnP JS Core) wrapper helper for Node.js
Consider using pnp-auth as a successor which soaked the best of
sp-pnp-nodeandnode-pnp-splibraries. I'm keepingsp-pnp-nodenot archived and update it from time to time only because of some production implementations which I'm too lazy to migrate topnp-authright away.
sp-pnp-node provides a simple way for using PnPjs in Node.js with support of various authentication strategies.
PnPjs Client Side Libraries for Microsoft 365 was created to help developers by simplifying common operations within SharePoint and the SharePoint Framework. Currently it contains a fluent API for working with the full SharePoint REST API as well as utility and helper functions. This takes the guess work out of creating REST requests, letting developers focus on the what and less on the how.
npm install sp-pnp-node @pnp/pnpjs@^1.3.11
Can be as simple as 5 lines of code:
import { Web } from '@pnp/sp';
import { PnpNode } from 'sp-pnp-node';
new PnpNode().init().then(settings => {
const web = new Web(settings.siteUrl);
/// ... // <<< Here goes PnP JS Core code
}).catch(console.log);

sp-pnp-node has two modes:
PnPjs with promise based auth wizard helperfetchClientFactory implementationWhen to use ambient init: in scripts with user interaction involved when there is no information about authentication and target invironment before script is executed. SharePoint url and the creds are prompted in a console.
In CI/CD scenarios, factory approach is recommended over interactive console as it can lead to a task stuck.
import { Web } from '@pnp/sp';
import { PnpNode, IPnpNodeSettings } from 'sp-pnp-node';
const optionalInitSettings: IPnpNodeSettings = {
// ...
};
new PnpNode(optionalInitSettings).init().then((settings: IPnpNodeSettings) => {
// Here goes PnP JS Core code >>>
const web = new Web(settings.siteUrl);
// Any SPWeb url can be used for `new Web(...)`
// not necessarily which is provided in `optionalInitSettings`
// Get all list example
web.lists.get()
.then(lists => {
console.log(lists.map(list => list.Title));
})
.catch(console.log);
// <<< Here goes PnP JS Core code
}).catch(console.log);
import * as pnp from '@pnp/sp';
import { PnpNode, IPnpNodeSettings } from 'sp-pnp-node';
const config = require('../config/private.json');
const pnpNodeSettings: IPnpNodeSettings = {
// siteUrl - Optional if baseUrl is in pnp.setup or in case of `new Web(url)`
siteUrl: config.siteUrl,
authOptions: config
};
pnp.sp.setup({
sp: {
fetchClientFactory: () => new PnpNode(pnpNodeSettings),
// baseUrl - Optional if siteUrl is in IPnpNodeSettings or in case of `new Web(url)`
baseUrl: config.siteUrl
}
});
pnp.sp.web.get()
.then(console.log)
.catch(console.log);
// Or
/*
new Web('http://adhoc.url/sites/site').get()
.then(console.log)
.catch(console.log);
*/
const { Web } = require('@pnp/sp');
const { PnpNode } = require('sp-pnp-node');
new PnpNode().init().then(settings => {
// Here goes PnP JS Core code >>>
const web = new Web(settings.siteUrl);
// Get all content types example
web.contentTypes.get()
.then(cts => {
console.log(cts.map(ct => {
return {
name: ct.Name,
description: ct.Description
};
}));
})
.catch(console.log);
// <<< Here goes PnP JS Core code
}).catch(console.log);
import { sp } from '@pnp/sp';
import { PnpNode, IPnpNodeSettings } from 'sp-pnp-node';
new PnpNode().init().then((settings: IPnpNodeSettings) => {
sp.setup({
sp: {
headers: {
// 'Accept': 'application/json;odata=verbose'
'Accept': 'application/json;odata=minimalmetadata'
// 'Accept': 'application/json;odata=nometadata'
}
}
});
// ...
}).catch(console.log);
import { PnpNode } from 'sp-pnp-node';
const pnpNodeSettings: IPnpNodeSettings = {
/// ...
};
new PnpNode(pnpNodeSettings).init().then(settings => {
// Here goes PnP JS Core code
}).catch(console.log);
import { PnpNode } from 'sp-pnp-node';
declare const global: any;
new PnpNode().init().then(settings => {
// Any raw RESP API requests with Fetch client
global.fetch(`${settings.siteUrl}/_api/web`, {
method: 'GET',
headers: {
accept: 'application/json;odata=minimalmetadata'
}
})
.then(response => response.json())
.then(console.log)
.catch(console.log);
});
node-sp-auth credentials optionsnode-sp-auth-config options
Settings can be left blank. Auth options in such a case will be asked by node-sp-auth-config options in a wizard like approach.
authOptions:
node-sp-auth formatSharePoint On-Premise (2013, 2016):
SharePoint Online:
This project was inspired by Sergei Sergeev and Patrick Rodgers. Main ideas were taken from node-pnpjs-sample and Using PnP JS Core and node-sp-auth. The result project implements the same concepts with a goal of reusability and maintenance simplification.
FAQs
SharePoint JavaScript Core Library (PnP JS Core) wrapper helper for Node.js
We found that sp-pnp-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.