
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@formfeed/devkit
Advanced tools
Formfeed template folders, project config and local rendering, shared by the CLI and @formfeed/testing.
The local half of the Formfeed development kit: template folders, project
configuration (formfeed.json) and offline rendering with the same engine the API uses. The
formfeed CLI and
@formfeed/testing are built on it; use it
directly when you write your own tooling around a template repository.
npm install @formfeed/devkit
import { defaultData, diagnose, projectAround, readTemplate, renderLocal } from '@formfeed/devkit';
// a folder with template.html, template.json, style.css, data/*.json (see the project layout docs)
const project = projectAround('templates/invoice-de');
const tpl = readTemplate(project, 'invoice-de');
const { data } = defaultData(tpl); // data/default.json, or the first data set
console.log(diagnose(tpl, data)); // the editor's diagnostics: syntax errors, unknown variables
const { document } = await renderLocal(project, tpl, data, { mode: 'print' }); // complete HTML, no browser
A folder can hold a Word or PowerPoint document (template.docx or template.pptx) instead of the
HTML files; readTemplate returns it as tpl.file and templateFileName(kind) names the file for
a kind. diagnose lists such a template's findings by part and paragraph, renderOfficeLocal fills
it (bytes, warnings) and officeSnapshot(bytes) turns the filled file into readable XML for
snapshot tests:
import { officeSnapshot, readTemplate, renderOfficeLocal } from '@formfeed/devkit';
const offer = readTemplate(project, 'offer');
const filled = await renderOfficeLocal(project, offer, { customer: { name: 'Olvarest GmbH' } });
console.log(filled.warnings, officeSnapshot(filled.bytes));
renderLocal works on HTML templates only. Errors are DevkitError instances with a code, which
the CLI maps to its exit codes.
MIT
FAQs
Formfeed template folders, project config and local rendering, shared by the CLI and @formfeed/testing.
The npm package @formfeed/devkit receives a total of 511 weekly downloads. As such, @formfeed/devkit popularity was classified as not popular.
We found that @formfeed/devkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.