
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Scrape and parse search engine results using SerpApi. Get search results from Google, Bing, Baidu, Yandex, Yahoo, Home Depot, eBay and more.
🪧 Coming from google-search-results-nodejs? Check out the migration document to find out how to upgrade. |
|---|
npm install serpapi
# or if you prefer yarn
yarn add serpapi
const { getJson } = require("serpapi");
getJson({
engine: "google",
api_key: API_KEY, // Get your API_KEY from https://serpapi.com/manage-api-key
q: "coffee",
location: "Austin, Texas",
}, (json) => {
console.log(json["organic_results"]);
});
import syntax and top-level await, you need to use
at least Node.js 14.8.0.You will need to add "type": "module" to your package.json:
{
"type": "module",
// rest of package.json
}
import { getJson } from "serpapi";
const response = await getJson({
engine: "google",
api_key: API_KEY, // Get your API_KEY from https://serpapi.com/manage-api-key
q: "coffee",
location: "Austin, Texas",
});
console.log(response);
import { getJson } from "https://deno.land/x/serpapi/mod.ts";
const response = await getJson({
engine: "google",
api_key: API_KEY, // Get your API_KEY from https://serpapi.com/manage-api-key
q: "coffee",
location: "Austin, Texas",
});
console.log(response);
You can declare a global api_key and timeout value by modifying the config
object. timeout is defined in milliseconds and defaults to 60 seconds.
All functions, other than getLocations, accepts an optional api_key and
timeout that will take precedence over the values defined in config.
getLocations doesn't require an API key.
import { config, getJson } from "serpapi";
config.api_key = API_KEY;
config.timeout = 60000;
await getJson({ engine: "google", q: "coffee" }); // uses the API key defined in the config
await getJson({ engine: "google", api_key: API_KEY_2, q: "coffee" }); // API_KEY_2 will be used
You can use a proxy by passing requestOptions with an HttpsProxyAgent
instance. This can be done either globally through the config object or
per-request in the parameters.
First, install the required package:
npm install https-proxy-agent
# or if you prefer yarn
yarn add https-proxy-agent
Then use it in your code:
import { config, getJson } from "serpapi";
import { HttpsProxyAgent } from "https-proxy-agent";
// Global configuration
config.requestOptions = {
agent: new HttpsProxyAgent("http://proxy-server:port"),
};
// Or per-request configuration
await getJson({
engine: "google",
q: "coffee",
requestOptions: {
agent: new HttpsProxyAgent("http://proxy-server:port"),
},
});
Built-in pagination is not supported. Please refer to our pagination examples for a manual approach:
Get a JSON response based on search parameters.
parameters
object
search query parameters for the enginecallback fn? optional callback// single call (async/await)
const json = await getJson({ engine: "google", api_key: API_KEY, q: "coffee" });
// single call (callback)
getJson({ engine: "google", api_key: API_KEY, q: "coffee" }, console.log);
Get a HTML response based on search parameters.
parameters
object
search query parameters for the enginecallback fn? optional callback// async/await
const html = await getHtml({ engine: "google", api_key: API_KEY, q: "coffee" });
// callback
getHtml({ engine: "google", api_key: API_KEY, q: "coffee" }, console.log);
Get a JSON response given a search ID.
search_metadata.id key in the
response.async parameter.const response = await getJson({
engine: "google",
api_key: API_KEY,
async: true,
q: "coffee",
});
const { id } = response.search_metadata;
await delay(1000); // wait for the request to be processed.
// async/await
const json = await getJsonBySearchId(id, { api_key: API_KEY });
// callback
getJsonBySearchId(id, { api_key: API_KEY }, console.log);
Get a HTML response given a search ID.
search_metadata.id key in the
response.async parameter.const response = await getJson({
engine: "google",
api_key: API_KEY,
async: true,
q: "coffee",
});
const { id } = response.search_metadata;
await delay(1000); // wait for the request to be processed.
// async/await
const html = await getHtmlBySearchId(id, { api_key: API_KEY });
// callback
getHtmlBySearchId(id, { api_key: API_KEY }, console.log);
Get account information of an API key. https://serpapi.com/account-api
parameters
object
(optional, default {})
callback fn? optional callback
// async/await
const info = await getAccount({ api_key: API_KEY });
// callback
getAccount({ api_key: API_KEY }, console.log);
Get supported locations. Does not require an API key. https://serpapi.com/locations-api
parameters
object
(optional, default {})
callback fn? optional callback
// async/await
const locations = await getLocations({ limit: 3 });
// callback
getLocations({ limit: 3 }, console.log);
FAQs
Scrape and parse search engine results using SerpApi.
The npm package serpapi receives a total of 93,538 weekly downloads. As such, serpapi popularity was classified as popular.
We found that serpapi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.