npmpackage.info

Gathering detailed insights and metrics for jsecrets

jsecrets - 1.0.0 | npmpackage.info

jsecrets

jsecrets is a wrapper around AWS Secrets Manager for your JavaScript projects.

1.0.0

MIT

JavaScript

9.27 kB

2.5

Installations

npm install jsecrets

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

12.13.0

NPM Version

6.12.0 Score

56.8

Supply Chain

Quality

74.3

Maintenance

100

Vulnerability

99.3

License

Pull Requests

Open

0

Total

2

Closed

0

Merged

2

Issues

Open

0

Total

2

Closed

2

Releases

Unable to fetch releases

Languages

JavaScript

JavaScript (100%)

Developer

pixielabs

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

6 Stars

7 Commits

4 Watchers

1 Branches

1 Contributors

Updated on Apr 18, 2024

Maintainers

View All 1 Contributors

Package Meta Information

Latest Version

1.0.0

Package Id

jsecrets@1.0.0

Unpacked Size

9.27 kB

Size

4.03 kB

File Count

NPM Version

6.12.0

Node Version

12.13.0

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

aws-sdk

Dev Dependencies

jest

jsecrets

jsecrets lets you fetch and use secrets from AWS Secrets Manager in your JavaScript projects. jsecrets is built and maintained by Pixie Labs.

You may want to use this if you use AWS Secrets Manager to store encrypted credentials, e.g. for your database, or for accessing an API with a token, and need to access those credentials in a backend JavaScript application e.g. an Express server, Lambda function, or some other backend piece of code.

Install

Add the package to your package.json with either NPM or Yarn:

1# With NPM:
2$ npm i -S jsecrets
3# With Yarn:
4$ yarn add jsecrets

Fetching secrets

jsecrets expects that your secrets are JSON objects stored in AWS Secrets Manager as strings.

1// app.js
2const jsecrets = require("jsecrets");
3
4try {
5  // Fetch secrets from AWS Secrets Manager with jsecrets.fetch(), passing in
6  // the region and an array of secret IDs. The secret ID can be the Amazon
7  // Resource Name (ARN) or the "friendly name" of the secret.
8  await jsecrets.fetch("eu-west-2", ["databaseSecret", "anotherSecret"]);
9
10  // Once the secrets have been retrieved, individual values can be extracted by
11  // passing in the name of the secret and the key to jsecrets.get().
12  const database = jsecrets.get("databaseSecret", "database");
13  const username = jsecrets.get("databaseSecret", "username");
14  const password = jsecrets.get("databaseSecret", "password");
15  const options = {
16    host: jsecrets.get("databaseSecret", "host"),
17    dialect: "postgres"
18  };
19
20  // You might then use those secrets to configure a DB connection, such as:
21  const sequelize = new Sequelize(database, username, password, options);
22
23  // The rest of your app goes here.
24
25} catch (e) {
26  console.log(e.message);
27}

Stubbing jsecrets in development

jsecrets has a helper method making it easy to stub calls to AWS when you are developing your application, and so don't need to use production secrets. Immediately after the import, call jsecrets.devStubs() passing in an object with the same shape as your secrets.The stubs will be used in all circumstances.

Wrap the call to jsecrets.devStubs() in a if block to ensure devStubs() is not called in production.

If you have multiple secrets, you can pass them all into jsecrets.devStubs() at once.

For example:

1const jsecrets = require('jsecrets');
2
3if (process.env.NODE_ENV != 'production') {
4  // Stub the return values of jsecrets.get() unless the app is running in
5  // production.
6  jsecrets.devStubs({
7    'databaseSecret': {
8      'database': 'jsecrets_node_app',
9      'host': 'localhost',
10      'username': 'pixielabs',
11      'password': 'pixielabs_secrets'
12    },
13    'anotherSecret': {
14      'jwt_signing_key': 'jsecret_signing',
15      'jwt_client_key': 'jsecret_client'
16    }
17  })
18}
19
20try {
21  // Fetch secrets from AWS Secrets Manager with jsecrets.fetch()
22  await jsecrets.fetch("eu-west-2", ["databaseSecret", "anotherSecret"]);

Errors

All errors returned by jsecrets will have a message key.

If the error is from AWS then there will also be other keys such as code, time and statusCode.

Contributing

Running the tests

Unit tests can be run with:

$ npm test

Feature tests are part of the example Express app within the exampleApp folder:

$ npm run exampleAppStart

In a new terminal:

$ npm run exampleAppTest

Before contributing, please read the code of conduct.

Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet.
Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it.
Fork the project.
Start a feature/bugfix branch.
Commit and push until you are happy with your contribution.
Please try not to mess with the package.json, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so we can cherry-pick around it.

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Maintained

Determines if the project is "actively maintained".

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Reason

57 existing vulnerabilities detected

Details

Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37
Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m
Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
Warn: Project is vulnerable to: GHSA-8hfj-j24r-96c4
Warn: Project is vulnerable to: GHSA-wc69-rhjr-hc9g
Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
Warn: Project is vulnerable to: GHSA-6chw-6frg-f759
Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
Warn: Project is vulnerable to: GHSA-rrc9-gqf8-8rwg
Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
Warn: Project is vulnerable to: GHSA-8r6j-v8pm-fqw3
Warn: Project is vulnerable to: MAL-2023-462
Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
Warn: Project is vulnerable to: GHSA-6c8f-qphg-qjgp
Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
Warn: Project is vulnerable to: GHSA-3jfq-g458-7qm9
Warn: Project is vulnerable to: GHSA-r628-mhmh-qjhw
Warn: Project is vulnerable to: GHSA-9r2w-394v-53qc
Warn: Project is vulnerable to: GHSA-5955-9wpr-37jh
Warn: Project is vulnerable to: GHSA-qq89-hq3f-393p
Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp

Score

2.5

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More