
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Tanda for your JavaScript
Caution: This library is complete (probably), but has not been tested. If you come across any problems open an issue, or be a champ and bust out a pull request.
node-tanda is now an isomorphic library, which can be used both in the browser or with node.js.
There are some differences with authentication, but there are (will be) handlers available for
a couple of the standard ways to authenticate with the standard server architectures.
yarn add tanda, or npm install --save tanda.
There are a couple of chainable options which don't line up exactly with what the API spec shows.
To enable show_costs on a call to the API, you should prepend .showCosts to the front on
your call. E.g. tanda.rosters.showCosts.get(1);.
The chainable options available are:
show_costs => .showCostsshow_award_interpretation => .showAwardInterpretationinclude_names => .includeNamesIf the option is available in the API docs, it'll be available. If your IDE is worth it's weight, it should show it as an option for you.
import Tanda from 'tanda';
const tanda = new Tanda({ authToken: '12345' });
tanda.rosters.get(1).then(rosters => console.log(rosters));
tanda.timesheets.showAwardInterpretation.current().then(timesheet => console.log(timesheet));
// etc, etc
This library runs in both the client and the server. If you're using Webpack or Babel, you can
really do whatever. If you're using older-school Node.js, a standard var Tanda = require ('tanda') should be fine. For the browser, there is a pre-made package you can use. If you
download the browser script, from ./out, it will expose window.Tanda which you can use.
MIT Licence
FAQs
An isomorphic wrapper for Tanda's v2 API.
The npm package tanda receives a total of 4 weekly downloads. As such, tanda popularity was classified as not popular.
We found that tanda demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.