
Security News
The Nightmare Before Deployment
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.
@fiberplane/source-analysis
Advanced tools
This package is intended for finding the hono routes/app instances in a give codebase
This package is intended for finding the hono routes/app instances in a give codebase
It uses the user's typescript library and configuration (but falls back to the bundled typescript version and the default compiler configuration).
Given the current approach, the project this package is trying to analyze should:
.ts and .tsx is used)The goal is to find all routes of a users' hono application, knowing that we'd like to find out which code is actually used for that. This way we can provide an LLM with context around what the application accepts/uses (like database schema, zod validation schemas, etc).
The typical way of using it is as follows:
import { createRoutesMonitor } from "@fiberplane/source-analysis"
const location = process.cwd();
const monitor = createRoutesMonitor(location);
monitor.start()
.then(() => {
// All files have been found
console.log('ready');
// By default the monitor will immediately start to analyze the code
// and it will be made available via the `lastSuccessfulResult`
console.log(monitor.lastSuccessfulResult);
// Force a manual update:
monitor.updateRoutesResult();
// Or you can also listen for "analysisStarted" and "analysisCompleted" events
monitor.addListener("analysisCompleted", (event) => {
if (event.payload.success) {
console.log('Got this route factory', event.payload.factory)
} else {
console.log("Encountered the following error", event.payload.error /* string */),
}
});
// In the end you can call stop on the monitor when it's no longer needed
monitor.stop()
})
The result of a successful analysis is a RoutesResult. This is an instance of a class that can be used to get a hono app which mimics all routes that have been found. When the hono instance receives a request, the RoutesResult instance will be updated with which routes have been called. You can then call the getFilesForHistory method on the RouteResult instance. This will generate a string containing (most) of the code that could be involved if that request was made to the actual application.
/* index.ts */
import { cors } from "hono/cors";
import { getProfile as getUserProfile } from "./db";
const app = new Hono();
app.get("/user/1/profile", cors()async (c) => {
const profile = await getUserProfile();
return c.json(profile);
}
/* EOF: index.ts */
/* db.ts */
import { measure } from "@fiberplane/hono-otel";
import { path } from "node:path";
const sleep = (duration = 100) =>
new Promise((resolve) => setTimeout(resolve, duration))
export const getUser = measure("getUser", async () => {
await sleep();
// Do something silly with the path module
const parent = path.resolve(__dirname, "..");
console.log("parent folder", parent);
const value = {
name: "John Doe",
email: "john@doe.com",
};
return value;
});
export async function getProfile() {
const user = await getUser();
await sleep(10);
return {
...user,
image: "https://xsgames.co/randomusers/avatar.php?g=pixel",
};
}
/* EOF: db.ts */
As can be seen above it concatenates all files into a single file with some comments around the actually involved filenames.
There are several strategies that we've been thinking about, specify the main entry of an application, find the hono app in that file and go through the source code from there. The downside there is that the entry file would need to be specified (or found out by our code base), The alternative is to analyze all source code and find variables that are of the Hono< generic type. This is the strategy this package uses
A high level description of the approach is:
ResourceManager under the hood.RoutesResult. This contains:
getFilesForHistory() method that can be called to see all code that can be executed for a request to an endpoint.resetHistory() method so you can reset the result to the initial state.The @fiberplane/source-analysis package uses several key data structures to represent the elements of your TypeScript project. Understanding these data structures can be helpful if you want to work in this package.
RouteTreeThe RouteTree type represents a reference to an app instance created with new Hono(). It contains a list of entries, which includes information about calls to the app (such as app.get(), app.use(), and app.route()).
export type RouteTree = {
id: RouteTreeId;
type: "ROUTE_TREE";
entries: RouteTreeEntry[];
// other properties...
};
RouteTreeEntryThe RouteTreeEntry type represents an entry in a route tree. It can be one of the following types:
RouteEntry. This represents a call to app.get()RouteTreeReference. This is the data structure for app.route()MiddlewareEntry. Represents calls to app.use()export type RouteTreeEntry = RouteEntry | RouteTreeReference | MiddlewareEntry;
In order to capture/store information about other code the packages uses two other data structures:
SourceReference This is a reference to section of code (like a function, a constant, etc). A source reference can refer to one or more SourceReference as well as one or more ModuleReferencesModuleReference represents a link to another file/external package and is source code (part of) an import statement.All data structures (apart from ModuleReference can contain references to either modules or source references).
compilerOptions.paths) actually work (https://www.typescriptlang.org/tsconfig/#paths)FAQs
This package is intended for finding the hono routes/app instances in a give codebase. This was initially created to provide context for requests to an LLM. In studio you can use an LLM to generate parameters for your request. However there is more that s
The npm package @fiberplane/source-analysis receives a total of 4 weekly downloads. As such, @fiberplane/source-analysis popularity was classified as not popular.
We found that @fiberplane/source-analysis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.

Research
/Security News
Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.