
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
vrchat-api-library
Advanced tools
🔥🔥 Your All-in-One Node.js API Solution for Seamless Interaction with VRChat's REST API and real-time events using Websockets! ✅✅
VRChat API Library is a Node.js library that allows easy integration of the VRChat API into your applications.
It provides real-time event handling through WebSockets, all endpoints and API sections are built according to the community driven VRChat API Docs.
Feel free to reach out on the Discord server below for support or inquiries.
All dates in this document are formatted as YYYY-MM-DD (ISO 8601).
Official Disclaimer from VRChat (Tupper):
Use of the VRChat API using applications other than the approved methods (website, VRChat application) is not officially supported. When using the API, please adhere to the following guidelines:
VRChat API Library is a Node.js module that streamlines integration with the VRChat platform.
It allows you to interact with VRChat's APIs, enabling essential features and offering QOL utilities & improvements, such as:
Each API section and endpoints are mostly built in reference to the community-driven VRChat API Docs, with exception to the real-time EventsApi.
Install the library via NPM:
npm install vrchat-api-library
const { VRChat, Enums } = require('vrchat-api-library');
const { VRChat, Enums } = require('vrchat-api-library');
const { stdin, stdout } = require('process');
const readline = require('readline');
const vrchat = new VRChat();
// Promise based console input function.
// Any promise-based input will work assuming it returns the two-factor authentication code.
function Prompt(query) {
const question = readline.createInterface({
input: stdin,
output: stdout,
});
return new Promise(resolve => question.question(query, res => {
question.close();
resolve(res);
}));
}
// Main asynchronous method.
const asyncMethod = async () => {
const auth = await vrchat.Authenticate({
username: "username",
password: "password",
authCookie: "",
twoFactorAuth: ""
}, async (type) => {
return await Prompt(`Please input ${type} two factor code:\n`);
});
console.log(auth); // Logs authentication information as a JSON object to console.
// Method ignoring errors.
const friendsArray = await vrchat.FriendsApi.ListFriends({ n: 100, offline: true }); // Get an Array of LimitedUser objects as documented on the Community-driven API Docs.
for(let i = 0; i < friendsArray.length; i++) {
console.log(friendsArray[i].displayName); // Log display names of all offline friends to console returned from the API function call above.
}
// Method catching & handling errors. (I recommend catching & handling your errors, otherwise you could run into catastrophic errors that break your applications at runtime)
// Get an Array of LimitedUser objects as documented on the Community-driven API Docs and only log names if there was no error, otherwise log the error.
await vrchat.FriendsApi.ListFriends({ n: 100, offline: true }).then(res => {
for(let i = 0; i < res.length; i++) {
console.log(res[i].displayName); // Log display names of all offline friends to console returned from the API function call above.
}
}).catch(err => console.log(err));
// Basic EventsApi usage, making use of the VRChat class.
vrchat.EventsApi.Connect();
// Usage of custom undocumented event type, this isn't valid, just for demonstration purposes.
// Upon getting an undocumented event type, the library will warn you in the console and ask you to report it. (Please do this!!)
vrchat.EventsApi.on("undocumented event", (data) => {
console.log("Undocumented Event");
console.log(data);
});
vrchat.EventsApi.on(Enums.EventType.error, (err) => {
console.log("Error: " + err.message);
});
vrchat.EventsApi.on(Enums.EventType.userOnline, (data) => {
console.log("User online");
console.log(data);
});
vrchat.EventsApi.on(Enums.EventType.userOffline, (data) => {
console.log("User offline");
console.log(data);
});
// vrchat.EventsApi.Disconnect(); -- Optionally disconnect from the API
}
asyncMethod(); // run asynchronous code from a synchronous context.
Here's a comprehensive overview of the classes and APIs available in the library:
All APIs can also be found at the community-driven VRChat API Docs, with exception to the EventsApi.
All API's excluding the VRChat class, EventsApi & AuthenticationApi now use constructed response objects as documented in the community-driven VRChat Docs, such as the GetOwnAvatar function returning a constructed Avatar object.
Description: The EventsApi class offers a highly stable WebSocket connection for real-time events related to users and friends.
Features:
As of v2.0.0, this package no longer uses the GPLv3 license and now uses the permissive MIT license, which as the sole developer of this project, I feel is more suitable for this project considering it is an NPM package that could be a dependency to other projects.
This will allow you to use this package as a dependency without having to source the original work or use the same license.
THIS DOES NOT APPLY TO VERSIONS PRIOR TO v2.0.0
All dates in this document are formatted as YYYY-MM-DD (ISO 8601).
v2.0.0 (2024-03-12)
v1.2.5 (2023-10-16)
v1.2.4
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.1.0
v1.0.9
v1.0.8
v1.0.7
v1.0.6
License: MIT
FAQs
🔥🔥 Your All-in-One Node.js API Solution for Seamless Interaction with VRChat's REST API and real-time events using Websockets! ✅✅
The npm package vrchat-api-library receives a total of 4 weekly downloads. As such, vrchat-api-library popularity was classified as not popular.
We found that vrchat-api-library demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.