
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
tp-link-tapo-connect
Advanced tools
Unofficial Node.js library for connecting to TP-Link Tapo devices. Currently limited to the:
npm install tp-link-tapo-connect
In order to discover your devices it is advisable to login to your TP-Link account and call the listDevices function. To do this:
const cloudApi = await cloudLogin(email, password);
const devices = await cloudApi.listDevicesByType('SMART.TAPOPLUG');
Once you have determined which device you wish to use. You can enquire of its current state using:
const device = await loginDevice(email, password, devices[0]); // Performs a mac lookup to determine local IP address
// OR
const device = await loginDeviceByIp(email, password, deviceIp); // If you know your local device IP address
const getDeviceInfoResponse = await device.getDeviceInfo();
console.log(getDeviceInfoResponse);
To change the device state e.g. turn it on or off use:
await device.turnOn();
await device.setBrightness(75); // Sets brightness to 75% for smart bulbs only
await device.turnOff();
Changing the bulb colour (Colour smart bulbs only):
await device.turnOn();
await device.setColour('white'); // Sets the colour for colour smart bulbs only
await device.setColour('#FF00FF'); // Sets the colour for colour smart bulbs only using a hex value
await device.turnOff();
| white |
| warmwhite |
| daylightwhite |
| blue |
| red |
| green |
| yellow |
const cloudVideos = await cloudApi.tapoCareCloudVideos(deviceId); //deviceId from listDevicesByType
Version 2 favours returning a device object that has the necessary functions to manipulate the device rather than passing the device/cloud token.
e.g.
const deviceToken = await loginDeviceByIp(email, password, deviceIp);
await turnOn(deviceToken);
is now
const device = await loginDeviceByIp(email, password, deviceIp);
await device.turnOn();
It is now possible to turn on & off devices using the cloud api (Doesn't require to be on the same network as the device). This functionality is limited at this time and only seems to work for older Kasa (HS100) devices.
const cloudApi = await cloudLogin(email, password);
const devices = await cloudApi.listDevicesByType('IOT.SMARTPLUGSWITCH');
const cloudDevice = cloudApi.getTapoDevice(devices[0]);
await cloudDevice.turnOn();
Support for the Tapo Hub (H100) is now availaible and can be accessed as follows:
const device = await loginDeviceByIp(email, password, deviceIp);
await device.playAlarm(AlarmTone.DoorbellRing8, AlarmVolume.high);
const hubDevices = await device.getHubDevices();
const hubDeviceId = hubDevices[0].deviceId;
const eventLogs = await device.getEventLogs(hubDeviceId);
Credit to this API go to:
FAQs
JS Library for connecting to TP-Link Tapo devices
The npm package tp-link-tapo-connect receives a total of 264 weekly downloads. As such, tp-link-tapo-connect popularity was classified as not popular.
We found that tp-link-tapo-connect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.