Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@azure/avocado
Advanced tools
Another Validator of OpenAPI spec repository Configuration And Directories.
NPM: https://www.npmjs.com/package/@azure/avocado
Avocado validates folder structure and configuration.
Avocado can be integrated into Azure pipeline to validate OpenAPI spec repository. For example, Avocado is used by Azure/azure-rest-api-specs
now that will trigger automatically by azure DevOps pipeline when a new pull request is created.
Avocado major functions are listed below:
specification
and filter readme.md
under the specification
folder.readme.md
is autorest specific file which must contain see https://aka.ms/autorest
swagger file
is valid json file, and check all referenced json
file (referenced json
file marked in json object has the key name "$ref"
).swagger file
must be referenced by readme.md
or other swagger file
.swagger file
has a circular reference and report a warning. For more detail, see CIRCULAR REFERENCEnpm install -g @azure/avocado
avocado
When type avocado in command line, avocado will validate in the current directory.
NOTE: When running in azure devops Avocado only report new errors involved in PR, but ignore the previous existing errors. When running in local machine, Avocado report all errors.
azure/azure-rest-api-specs
and run "avocado" in folder azure/azure-rest-api-specs
.specification
. and move your service specs folder in specification
. run "avocado"Level: WARNING
To solve circular reference, you should break the circular chain.
Example: a.json
-> b.json
->c.json
// a.json
{ "$ref": "b.json" }
// b.json
{ "$ref": "c.json" }
// c.json
{ "$ref": "a.json" }
graph TD
A((a.json))-->B((b.json))
B-->C((c.json))
C-->A
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
0.6.1
Readme.md
.package-lock.json
. restrict tslint version ~5.18.0
FAQs
A validator of OpenAPI configurations
The npm package @azure/avocado receives a total of 21,469 weekly downloads. As such, @azure/avocado popularity was classified as popular.
We found that @azure/avocado demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.