
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@expo/schemer
Advanced tools
@expo/schemer
A Schema validation library for Expo.
Details can be found here:
import { getConfig } from '@expo/config';
import Schemer from '@expo/schemer';
const { exp } = getConfig(projectRoot);
const schema = await getSchemaAsync(exp.sdkVersion);
const validator = new Schemer(require('schema.json'));
validator.validateName('Wilson Zhao');
validator.validateAssets(exp);
const validator = new Schemer(require('schema.json'));
try {
await validator.validateSchemaAsync(require('data.json'));
} catch (e) {
console.error(e);
}
const validator = new Schemer(require('schema.json'));
await validator.validateName('Wilson Zhao');
Schemer takes in a custom JSON Schema and uses it to validate various data.
Under the hood, it uses Ajv (https://github.com/epoberezkin/ajv) as the Javascript engine for basic schema validation. However, each subschema also contains a custom meta tag, which can be parsed for further "manual" validation. As of now, Schemer supports manual validation for assets:
{
meta:
{
asset,
contentType, //mime type
dimensions: {width, height},
square,
// For custom error messages and docs
regexHuman,
autogenerated,
notHuman
}
}
All errors can be accessed in this.errors, which has a getter function that combines Ajv JSON Schema errors with custom meta/asset validation errors into a unified array of ValidationErrors.
If they exist, the errors are thrown at the end of each public-facing function.
All public-facing functions are async functions because asset validation has to be async (accessing the file-system or making a web request).
Returns a promise that resolve to true if the data is conforms to the schema. Otherwise, it rejects and throws an array of ValidationErrors.
Returns a promise that resolve to true if the data is conforms to the additional validation steps found in each meta tag. For example, it will download an asset and read the header of the file to see if it is a certain content type.
Otherwise, it rejects and throws an array of ValidationErrors.
Runs both .validateSchemaAsync and .validateAssetsAsync.
Returns a promise that resolve to true if the data passes both functions. Otherwise, it rejects and throws an array of ValidationErrors.
Extracts the subSchema for the given field path and validates the data against it. Also checks for the meta tag.
Returns a promise that resolve to true if the data conforms to the subschema. Otherwise, it rejects and throws an array of ValidationErrors.
Contains an array of ValidationErrors
FAQs
Centralized scheme validation library for Expo
The npm package @expo/schemer receives a total of 60,287 weekly downloads. As such, @expo/schemer popularity was classified as popular.
We found that @expo/schemer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Ā It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.