
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@fireflysemantics/validatorts
Advanced tools
A typescript library of validators and sanitizers based on validator.js.
The Typedoc contains documentation for all the validators and sanitizers.
npm i -S @fireflysemantics/validatorts tslib
import { isPort } from '@fireflysemantics/validatorts';
console.log(isPort('4200').value) //Logs true
console.log(isPort('70000').value); //Logs false
console.log(isPort('4200').error); //Logs undefined
In the event of an error the Result.value property will be undefined and both the message and error properties will be set, thus we can handle and error like this:
if (isPort(4200).error) {
console.log(isPort(4200).value); //Logs undefined
console.log(isPort(4200).message); //The target argument 4200 is not a string.
}
To see what types of errors can occur see the Typedoc for the API being used.
For more details on the error handling design and approach see Typescript Exception Free Function Error Handling.
Each validator and sanitizer returns a Result instance with this interface:
/**
* The result of validation and sanitation calls.
*/
export class Result<E> {
public message?:string
constructor(
public value: E | undefined,
public error?: MessageFunctionType,
public parameters?: string[]
) {
if (error) {
this.message = this.error!(parameters)
}
}
}
From the project root run npm run b
Run the Jest Tests for ValidatorTS
npm t
This project was generated with Angular CLI version 12.1.2.
npm run doc
Typedoc will be contained in the doc folder of the root directory.
The library is built with the Angular Package Format. It therefore supports all these package formats (As can be seen in the provided package.json) and has integrated typescript definitions:
FAQs
Data Validation and Sanitization
We found that @fireflysemantics/validatorts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.