
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Simple access to Zoho REST APIs
npm i zoho-api
The library requires a tokens file in JSON format where it stores the access and refresh tokens. To set this up, a grant token is required, which should be generated in the Zoho Developer console: https://api-console.zoho.com/
Click on '+ Add new client' -> Self-client
After that, click on the newly created client and go to the "Generate Code" tab. On the scopes input you can use any Zoho scopes that you need, for example:
ZohoCRM.modules.ALL,ZohoCRM.settings.ALL,ZohoCRM.coql.READ
Choose the time duration (10 mins if you need time to run the setup script)
You can leave Scope Description empty.
Click on 'Create' and a token will be displayed, copy that token.
In the examples library there's a setup script to copy, but I'll mark all the steps here:
Create a file called 'setup.js' in the root of your project.
Paste the following code:
const Zoho = require('zoho-api');
const api = new Zoho.Api({
clientId: '1000.XXXXXXXXXXXXXXXXXXXXXXXXX',
clientSecret: '1111xx...........',
tokenFile: __dirname + '/path/to/tokens.json', // Absolute path from current directory
setup: true
});
api.setup('1000.YYYYYYYYYYYYYYYYYYYYYY')
.then((response) => {
console.log('Tokens file generated!');
})
.catch((err) => {
console.log('Something failed!');
console.log(err);
});
Replace with your clientId and clientSecret. For the 'tokenFile' config, just specify the file where you want to store your OAuth tokens, if the file doesn't exist, it will be created.
Use the grant token generated earlier to set it as the parameter for 'api.setup'.
node setup.js
If everything went well, the tokens file should have been created in the specified location, and a success message will be shown.
Delete the setup file.
In the examples directory check the 'usage.js' file for reference. Copying here an usage example:
const Zoho = require('zoho-api');
const api = new Zoho.Api({
clientId: '1000.XXXXXXXXXXXXXXXXXXXXXXXXX',
clientSecret: '011zzz.....................',
tokenFile: __dirname + '/files/tokens.json' // Absolute path from current directory
});
api.api('GET', '/settings/modules')
.then((response) => {
console.log('Got data!');
console.log(response.data);
});
The api is just a wrapper around the REST API, it only simplifies the token generation and re-utilization process. All the REST methods can be checked in the official docs: https://www.zoho.com/crm/developer/docs/api/v2/modules-api.html
Format:
api.api('METHOD', '/path/to/endpoint')
Examples:
api.api('GET', '/Leads');
api.api('GET', '/Accounts');
The query API allows clients to query Zoho modules as if they were SQL tables, check official docs about it: https://www.zoho.com/crm/developer/docs/api/v2/COQL-Overview.html
Example:
let query = "select Last_Name, Account_Name.Parent_Account, Account_Name.Parent_Account.Account_Name, First_Name, Full_Name, Created_Time from Contacts where Last_Name is not null limit 200";
api.coql(query)
.then((response) => {
console.log('Got COQL results!');
console.log(response.data);
});
FAQs
Simple access to Zoho REST APIs
The npm package zoho-api receives a total of 0 weekly downloads. As such, zoho-api popularity was classified as not popular.
We found that zoho-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.