Gathering detailed insights and metrics for @google-cloud/secret-manager
Gathering detailed insights and metrics for @google-cloud/secret-manager
Google Cloud Client Library for Node.js
Installations
npm install @google-cloud/secret-managerReleases
2,195
developerconnect: v0.2.0
developerconnect-v0.2.0
Published on 21 Nov 2024
run: v1.5.0
run-v1.5.0
Published on 21 Nov 2024
network-management: v3.10.0
network-management-v3.10.0
Published on 21 Nov 2024
dialogflow: v6.12.0
dialogflow-v6.12.0
Published on 21 Nov 2024
datastream: v3.3.0
datastream-v3.3.0
Published on 21 Nov 2024
dataplex: v3.12.0
dataplex-v3.12.0
Published on 21 Nov 2024
Developer
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
>=14.0.0
Typescript Support
No
Node Version
14.21.3
NPM Version
6.14.18
Statistics
2,928 Stars
24,640 Commits
598 Forks
187 Watching
202 Branches
331 Contributors
Updated on 28 Nov 2024
Bundle Size
1.51 MB
Minified
248.07 kB
Minified + Gzipped
Languages
TypeScript (89.16%)
JavaScript (10.8%)
Shell (0.02%)
Python (0.02%)
Total Downloads
Cumulative downloads
Total Downloads
59,115,616
Last day
-5%
102,161
Compared to previous day
Last week
5.5%
580,146
Compared to previous week
Last month
10%
2,414,146
Compared to previous month
Last year
52.6%
24,038,077
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Versions
Google Cloud Node.js Client Libraries
Node.js idiomatic client libraries for Google Cloud Platform services.
Libraries are available on GitHub and npm for developing Node.js applications that interact with individual Google Cloud services:
If the service is not listed above, google-api-nodejs-client interfaces with additional Google Cloud APIs using a legacy REST interface.
When building Node.js applications, preference should be given to the libraries listed in the table.
Enabling APIs
Before you can interact with a given Google Cloud Service, you must enable its API.
Links are available for enabling APIs in the table at the beginning of this document, and in each libraries README.md.
Authentication
Download your Service Account Credentials JSON file
To use Application Default Credentials, You first need to download a set of JSON credentials for your project. Go to APIs & Auth > Credentials in the Google Developers Console and select Service account from the Add credentials dropdown.
This file is your only copy of these credentials. It should never be committed with your source code, and should be stored securely.
Once downloaded, store the path to this file in the GOOGLE_APPLICATION_CREDENTIALS environment variable.
Other Authentication Methods
Other authentication methods are outlined in the README for google-auth-library-nodejs, which is the authentication library used by all Google Cloud Node.js clients.
Example Applications
- nodejs-getting-started - A sample and tutorial that demonstrates how to build a complete web application using Cloud Datastore, Cloud Storage, and Cloud Pub/Sub and deploy it to Google App Engine or Google Compute Engine.
- gcloud-node-todos - A TodoMVC backend using google-cloud-node and Datastore.
- gitnpm - Easily lookup an npm package's GitHub repo using google-cloud-node and Google App Engine.
- gcloud-kvstore - Use Datastore as a simple key-value store.
- hya-wave - Cloud-based web sample editor. Part of the hya-io family of products.
- gstore-node - Google Datastore Entities Modeling library.
- gstore-api - REST API builder for Google Datastore Entities.
Supported Node.js Versions
Our client libraries follow the Node.js release schedule. Libraries are compatible with all current active and maintenance versions of Node.js. If you are using an end-of-life version of Node.js, we recommend that you update as soon as possible to an actively supported LTS version.
Google's client libraries support legacy versions of Node.js runtimes on a best-efforts basis with the following warnings:
- Legacy versions are not tested in continuous integration.
- Some security patches and features cannot be backported.
- Dependencies cannot be kept up-to-date.
Client libraries targeting some end-of-life versions of Node.js are available, and
can be installed through npm dist-tags.
The dist-tags follow the naming convention legacy-(version).
For example, {{ metadata['lib_install_cmd'] }}@legacy-10 installs client libraries
for versions compatible with Node.js 10.
Versioning
Our libraries follow Semantic Versioning.
Please note it is currently under active development. Any release versioned 0.x.y is subject to backwards-incompatible changes at any time.
Stable: Libraries defined at the Stable quality level are stable. The code surface will not change in backwards-incompatible ways unless absolutely necessary (e.g. because of critical security issues) or with an extensive deprecation period. Issues and requests against Stable libraries are addressed with the highest priority.
Preview: Libraries defined at the preview quality level are still a work-in-progress and are more likely to get backwards-incompatible updates.
Contributing
Contributions to this library are always welcome and highly encouraged.
See CONTRIBUTING for more information on how to get started.
License
Apache 2.0 - See LICENSE for more information.
No vulnerabilities found.
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
0 existing vulnerabilities detected
Reason
no binaries found in the repo
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/continuous.yaml:1
- Warn: no topLevel permission defined: .github/workflows/issues-no-repro.yaml:1
- Warn: no topLevel permission defined: .github/workflows/presubmit.yaml:1
- Warn: no topLevel permission defined: .github/workflows/response.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-api-list.yaml:1
- Info: no jobLevel write permissions found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/continuous.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/continuous.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/continuous.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/continuous.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/issues-no-repro.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/issues-no-repro.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/issues-no-repro.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/issues-no-repro.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/presubmit.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/presubmit.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/presubmit.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/presubmit.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/response.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/response.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/response.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/response.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/response.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/response.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/response.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/response.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-api-list.yaml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/update-api-list.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-api-list.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/update-api-list.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-api-list.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/googleapis/google-cloud-node/update-api-list.yaml/main?enable=pin
- Warn: containerImage not pinned by hash: ci/Dockerfile:18
- Warn: containerImage not pinned by hash: ci/Dockerfile:37
- Warn: containerImage not pinned by hash: containers/node-bootstrap-container/Dockerfile:19
- Warn: containerImage not pinned by hash: containers/node-bootstrap-container/Dockerfile:23
- Warn: downloadThenRun not pinned by hash: ci/Dockerfile:35
- Warn: goCommand not pinned by hash: containers/node-bootstrap-container/Dockerfile:21
- Warn: npmCommand not pinned by hash: containers/node-bootstrap-container/Dockerfile:27
- Warn: npmCommand not pinned by hash: containers/node-bootstrap-container/entrypoint.sh:19
- Warn: npmCommand not pinned by hash: packages/google-cloud-secretmanager/ci/cloudbuild/test.sh:21
- Warn: npmCommand not pinned by hash: packages/google-cloud-secretmanager/ci/cloudbuild/test.sh:26
- Warn: npmCommand not pinned by hash: packages/google-cloud-secretmanager/ci/cloudbuild/test.sh:35
- Warn: npmCommand not pinned by hash: .github/workflows/update-api-list.yaml:15
- Info: 0 out of 10 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 3 third-party GitHubAction dependencies pinned
- Info: 0 out of 4 containerImage dependencies pinned
- Info: 0 out of 1 downloadThenRun dependencies pinned
- Info: 0 out of 1 goCommand dependencies pinned
- Info: 0 out of 6 npmCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
6.6
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More