
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
npm i thehandy
Using the library is a simple matter of initializing an instance of the Handy class, setting its connection key, and running commands!
Important: The API for this package has been completely rewritten from v1.x onwards to use the new v2 API from SweetTech, and is not compatible with previous versions. A version of the Handy class using calls to the old API exists as HandyLegacy, but I'm no longer worrying about keeping it up-to-date or bug-free. I strongly recommend that you switch to APIv2.
Using this library assumes an understanding of how the Handy API operates - specifically with regard to the newly differentiated modes - HAMP, HSSP, HDSP and HSTP.
import { Handy } from 'thehandy';
//initialize a new Handy object and set its connection key
const handy = new Handy();
handy.connectionKey = "ABCD1234";
//you can request info about the Handy
const info = await handy.getInfo();
console.log(`Handy conneted with firmware ${info.fwVersion}`);
//you can send requests to the Handy API
await handy.setMode(HandyMode.hamp);
await handy.setHampStart();
await handy.setHampVelocity(50);
Something to keep in mind when using this library is that while an effort has been made to make all the commands 'just work', the Handy requires you to set the mode and status to certain operations to run certain commands. For example, setHampVelocity will return an error if you try to call it when the Handy is not in HAMP mode.
While the Handy class makes an attempt to keep track of the Handy's internal state and to make the appropriate setMode calls (among others) to ensure your commands work, there are no guarantees that the Handy's state hasn't been changed from another application, or by the user.
So you should have appropriate logic in your application to handle these cases. In the example above, simply calling await handy.setHampVelocity(50) will generally work, as the library will detect that it needs to both run setMode(HandyMode.hamp) and setHampStart(), but to be safe, these calls were made explicitly first, to make certain that the Handy would be in the correct mode.
I've created a React wrapper package to make it easy to use The Handy in a React application using React Context.
Handy class)verbose (boolean)
connectionKey (string)
Handy class Will attempt to automatically store/retrieve this value from localStorage under the key connectionKeyconnected (false)
info (HandyInfo | undefined)
currentMode (HandyMode)
hampState (HampState)
hampVelocity (number)
hdspPosition (number)
hsspState (HsspState)
hsspLoop (boolean)
hsspPreparedUrl (string)
hstpTime (number)
hstpOffset (number)
hstpRtd (number)
estimatedServerTimeOffset (number)
slideMin (number)
slideMax (number)
slidePositionAbsolute (number)
Note - all methods on the Handy class are async!
getMode
nonePromise<HandyMode>setMode
(mode: HandyMode)Promise<SetModeResult>getConnected
nonePromise<boolean>getInfo
nonePromise<HandyInfo>getSettings
nonePromise<HandySettings>getStatus
nonePromise<HandyStatus>setHampStart
nonePromise<SetHampStateResult>setHampStop
nonePromise<SetHampStateResult>getHampState
nonePromise<{ result: GenericResult; state: HampState }>getHampVelocity
nonePromise<number>setHampVelocity
(velocity: number)Promise<GenericResult>setHdspXaVa
(positionAbsolute: number, velocityAbsolute: number, stopOnTarget?: boolean)Promise<SetHdspResult>setHdspXpVa
(positionPercentage: number, velocityAbsolute: number, stopOnTarget?: boolean)Promise<SetHdspResult>setHdspXpVp
(positionPercentage: number, velocityPercentage: number, stopOnTarget?: boolean)Promise<SetHdspResult>setHdspXaT
(positionAbsolute: number, durationMilliseconds: number, stopOnTarget?: boolean)Promise<SetHdspResult>setHdspXpT
(positionPercentage: number, durationMilliseconds: number, stopOnTarget?: boolean)Promise<SetHdspResult>setHsspPlay
(playbackPosition?: number, serverTime?: number)Promise<GenericResult>setHsspStop
nonePromise<GenericResult>setHsspSetup
(url: string, sha256?: string)Promise<HsspSetupResult>getHsspLoop
nonePromise<boolean>setHsspLoop
(loop: boolean)Promise<GenericResult>getHsspState
nonePromise<HsspState>getHstpTime
nonePromise<number>getHstpOffset
nonePromise<number>setHstpoffset
(offset: number)Promise<GenericResult>getHstpRtd
nonePromise<number>getHstpSync
getServerTimeOffset instead.(syncCount = 30, outliers = 6)Promise<GenericResult & { time: number; rtd: number }>getSlideSettings
nonePromise<SlideInfo>getSlidePositionAbsolute
nonePromise<number>setSlideSettings
(min: number, max: number)Promise<GenericResult>setSlideMin
(min: number, fixed = false)Promise<GenericResult>setSlideMax
(max: number, fixed = false)Promise<GenericResult>getServerTime
nonePromise<number>getServerTimeOffset
(trips = 30, onProgress?: (progress: number) => void)Promise<number>HandyUtils class)uploadCsv
setHsspSetup(csv: File, filename?: string)Promise<string>FAQs
A TypeScript wrapper around the public REST API for The Handy
The npm package thehandy receives a total of 479 weekly downloads. As such, thehandy popularity was classified as not popular.
We found that thehandy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.