phamleduy04 / yahoo-stock-api

💰 NPM package to get stock and historical price from finance.yahoo.com

yahoo-stock-api

💰 NPM package to get stock and historical price from finance.yahoo.com

⚠️ Breaking changes ⚠️

v2.0.0 of this package have breaking changes and can affect your code, please review it and change according to the documentation below!

![

Installaion

npm i yahoo-stock-api or yarn add yahoo-stock-api if you use yarn.

API

Everything in this API will return Promise so remember to use async/await or callback

getHistoricalPrices: async function({ startDate, endDate, symbol, frequency })

• startDate: Date
• endDate: Date
• symbol: String (stock symbol)
• frequency: String ('1d', '1wk' or '1mo' only)
  • 1d: 1day
  • 1wk: 1 week
  • 1mo: 1 month

Return Promise

Example

Code

const yahooStockAPI = require('yahoo-stock-api').default;

const yahoo = new yahooStockAPI();

const startDate = new Date('08/21/2020');
const endDate = new Date('08/26/2020');
yahoo.getHistoricalPrices({ startDate, endDate, symbol: 'AAPL', frequency: '1d' }).then(console.log);

Response

{
error: false,
currency: 'USD',
response: [
  {
    date: 1598418000,
    open: 126.18,
    high: 126.99,
    low: 125.08,
    close: 126.52,
    adjClose: 124.81,
    volume: 163022400
  },
  {
    date: 1598331600,
    open: 124.7,
    high: 125.18,
    low: 123.05,
    close: 124.82,
    adjClose: 123.13,
    volume: 211495600
  },
  {
    date: 1598245200,
    open: 128.7,
    high: 128.79,
    low: 123.94,
    close: 125.86,
    adjClose: 124.15,
    volume: 345937600
  },
  {
    date: 1597986000,
    open: 119.26,
    high: 124.87,
    low: 119.25,
    close: 124.37,
    adjClose: 122.68,
    volume: 338054800
  }
]
}

getSymbol({ symbol })

• symbol: String (stock symbol)

Return Promise

Example

Code

const yahooStockAPI = require('yahoo-stock-api').default;

const yahoo = new yahooStockAPI();

yahoo.getSymbol({ symbol: 'AAPL' }).then(console.log);

Response

{
error: false,
currency: 'USD',
response: {
  updated: 1673486286910,
  previousClose: 130.73,
  open: 131.25,
  bid: { value: 133.42, shares: 900 },
  ask: { value: 133.47, shares: 1000 },
  dayRange: { low: 130.46, high: 133.49 },
  fiftyTwoWeekRange: { low: 124.17, high: 179.61 },
  volume: 69458949,
  avgVolume: 83633004,
  marketCap: 2124000000000,
  beta: 1.27,
  peRatio: 21.85,
  eps: 6.11,
  earningsDate: { start: 1675317600, end: undefined },
  forwardDividend: 0.92,
  forwardYield: 0.71,
  exDividendDate: 1667538000,
  oneYearTargetEst: 173.25
}
}

Test

• Clone this Repo (git clone https://github.com/phamleduy04/yahoo-stock-api)
• Open Terminal (Command Line) in the folder.
• npm i
• npm test

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Duy Pham Le 💻

Rajat 🤔

Tommy Tang 💻 🐛

keiichi 💻

This project follows the all-contributors specification. Contributions of any kind welcome!

License

yahoo-stock-api's Issues

Yahoo finance api documentation

Ông có link document của yahoo finance ko cho tôi xin với. Tôi đang cần để viết Java

undici-5.15.0.tgz: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - undici-5.15.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.15.0.tgz

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (undici version)	Remediation Available
CVE-2023-24807	High	7.5	undici-5.15.0.tgz	Direct	undici - 5.19.1	❌
CVE-2023-23936	Medium	6.5	undici-5.15.0.tgz	Direct	undici - 5.19.1	❌

Details

CVE-2023-24807

Vulnerable Library - undici-5.15.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.15.0.tgz

Dependency Hierarchy:

• ❌ undici-5.15.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Publish Date: 2023-02-16

URL: CVE-2023-24807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r6ch-mqf9-qc9w

Release Date: 2023-02-16

Fix Resolution: undici - 5.19.1

Step up your Open Source Security Game with Mend here

CVE-2023-23936

Vulnerable Library - undici-5.15.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.15.0.tgz

Dependency Hierarchy:

• ❌ undici-5.15.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.

Publish Date: 2023-02-16

URL: CVE-2023-23936

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5r9g-qh6m-jxff

Release Date: 2023-02-16

Fix Resolution: undici - 5.19.1

Step up your Open Source Security Game with Mend here

Add contributors

For add contributors xD

🐞 Version 2.2.0 is broken

With version 2.2.0 I get this error.
Version 2.1.3 works fine.

Error: Cannot find module '/Users/manu/Coding/Typescript/stocks_scripts/node_modules/yahoo-stock-api/dist/index.js'. Please verify that the package.json has a valid "main" entry
    at tryPackage (node:internal/modules/cjs/loader:415:19)
    at Function.Module._findPath (node:internal/modules/cjs/loader:665:18)
    at Function.Module._resolveFilename (node:internal/modules/cjs/loader:1034:27)
    at Function.Module._resolveFilename.sharedData.moduleResolveFilenameHook.installedValue [as _resolveFilename] (/Users/manu/Coding/Typescript/stocks_scripts/node_modules/@cspotcode/source-map-support/source-map-support.js:811:30)
    at Function.Module._load (node:internal/modules/cjs/loader:901:27)
    at Module.require (node:internal/modules/cjs/loader:1115:19)
    at require (node:internal/modules/helpers:130:18)
    at Object.<anonymous> (/Users/manu/Coding/Typescript/stocks_scripts/src/repo.ts:1:23)
    at Module._compile (node:internal/modules/cjs/loader:1233:14)
    at Module.m._compile (/Users/manu/Coding/Typescript/stocks_scripts/node_modules/ts-node/src/index.ts:1618:23) {
  code: 'MODULE_NOT_FOUND',
  path: '/Users/manu/Coding/Typescript/stocks_scripts/node_modules/yahoo-stock-api/package.json',
  requestPath: 'yahoo-stock-api'
}
error Command failed with exit code 1.

Yahoo finance

Hi,
Is it also possible to load ratios like P/FCF, P/E, current ratio, quick ratio... or self-define ratios ?

undici-5.8.0.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - undici-5.8.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-5.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-35948	High	9.8	undici-5.8.0.tgz	Direct	5.8.2	❌
CVE-2022-35949	High	9.8	undici-5.8.0.tgz	Direct	undici - 5.8.2	❌

Details

CVE-2022-35948

Vulnerable Library - undici-5.8.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-5.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.8.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

undici is an HTTP/1.1 client, written from scratch for Node.js.=< [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header. Example: import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) The above snippet will perform two requests in a single request API call: 1) http://localhost:3000/ 2) http://localhost:3000/foo2 This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.

Publish Date: 2022-08-15

URL: CVE-2022-35948

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35948

Release Date: 2022-08-15

Fix Resolution: 5.8.2

Step up your Open Source Security Game with Mend here

CVE-2022-35949

Vulnerable Library - undici-5.8.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-5.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.8.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1. If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in [email protected]. The best workaround is to validate user input before passing it to the undici.request call.

Publish Date: 2022-08-12

URL: CVE-2022-35949

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35949

Release Date: 2022-08-12

Fix Resolution: undici - 5.8.2

Step up your Open Source Security Game with Mend here

undici-5.0.0.tgz: 1 vulnerabilities (highest severity is: 7.7) - autoclosed

Vulnerable Library - undici-5.0.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-32210	High	7.7	undici-5.0.0.tgz	Direct	5.5.1	❌

Details

CVE-2022-32210

Vulnerable Library - undici-5.0.0.tgz

An HTTP/1.1 client, written from scratch for Node.js

Library home page: https://registry.npmjs.org/undici/-/undici-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

undici 4.8.2 before 5.5.1 is vulnerable to MITM. Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Publish Date: 2022-06-02

URL: CVE-2022-32210

CVSS 3 Score Details (7.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pgw7-wx7w-2w33

Release Date: 2022-06-02

Fix Resolution: 5.5.1

Step up your Open Source Security Game with Mend here

undici-5.23.0.tgz: 4 vulnerabilities (highest severity is: 3.9)

Vulnerable Library - undici-5.23.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.23.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (undici version)	Remediation Possible**
CVE-2024-30260	Low	3.9	undici-5.23.0.tgz	Direct	undici - 5.28.4,6.11.1	❌
CVE-2024-24758	Low	3.9	undici-5.23.0.tgz	Direct	5.28.3	❌
CVE-2023-45143	Low	3.5	undici-5.23.0.tgz	Direct	5.26.2	❌
CVE-2024-30261	Low	2.6	undici-5.23.0.tgz	Direct	undici - 5.28.4,6.11.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-30260

Vulnerable Library - undici-5.23.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.23.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.23.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request(). This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Publish Date: 2024-04-04

URL: CVE-2024-30260

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m4v8-wqvr-p9f7

Release Date: 2024-04-04

Fix Resolution: undici - 5.28.4,6.11.1

Step up your Open Source Security Game with Mend here

CVE-2024-24758

Vulnerable Library - undici-5.23.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.23.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.23.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-02-16

URL: CVE-2024-24758

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-24758

Release Date: 2024-02-16

Fix Resolution: 5.28.3

Step up your Open Source Security Game with Mend here

CVE-2023-45143

Vulnerable Library - undici-5.23.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.23.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.23.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.

Publish Date: 2023-10-12

URL: CVE-2023-45143

CVSS 3 Score Details (3.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wqq4-5wpv-mx2g

Release Date: 2023-10-12

Fix Resolution: 5.26.2

Step up your Open Source Security Game with Mend here

CVE-2024-30261

Vulnerable Library - undici-5.23.0.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.23.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/undici/package.json

Dependency Hierarchy:

• ❌ undici-5.23.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Publish Date: 2024-04-04

URL: CVE-2024-30261

CVSS 3 Score Details (2.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9qxr-qj54-h672

Release Date: 2024-04-04

Fix Resolution: undici - 5.28.4,6.11.1

Step up your Open Source Security Game with Mend here

[feature] documentation

Hi, thanks for work.
Please add a little documentation or better readme.

Parse/Fix Response Value

Response value in getSymbol() function should be return number instead of string on some field like bid, ask, dayRange, ...

Fix marketCap field, should be a big number instead of a float.

Response:

{
  error: false,
  currency: 'USD',
  response: {
    updated: 1664826582407,
    previousClose: 138.2,
    open: 138.21,
    bid: '142.84 x 900',
    ask: '142.85 x 1000',
    dayRange: '137.68 - 143.07',
    fiftyTwoWeekRange: '129.04 - 182.94',
    volume: 96040272,
    avgVolume: 78897638,
    marketCap: 2.293,
    beta: 1.23,
    peRatio: 23.59,
    eps: 6.05,
    earningsDate: 'Oct 26, 2022 - Oct 31, 2022',
    forwardDividendYield: '0.92 (0.67%)',
    exDividendDate: 'Aug 05, 2022',
    oneYearTargetEst: 183.5
  }
}

New response:

{
  error: false,
  currency: 'USD',
  response: {
    updated: 1664826526353,
    previousClose: 138.2,
    open: 138.21,
    bid: { value: 142.8, shares: 900 },
    ask: { value: 142.81, shares: 1000 },
    dayRange: { low: 137.68, high: 143.07 },
    fiftyTwoWeekRange: { low: 129.04, high: 182.94 },
    volume: 95821008,
    avgVolume: 78897638,
    marketCap: 2293000000000,
    beta: 1.23,
    peRatio: 23.59,
    eps: 6.05,
    earningsDate: { start: 1666760400, end: 1667192400 },
    forwardDividend: 0.92,
    forwardYield: 0.67,
    exDividendDate: 1659675600,
    oneYearTargetEst: 183.5
  }
}