
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@gentleduck/gen
Advanced tools
Type-safe API and message generator for TypeScript projects (NestJS-tested).
Duck Gen scans your TypeScript server code and generates type-safe route maps and message registries. It is currently tested with NestJS.
pnpm add -D @gentleduck/gen
Create a duck-gen.json at your project root:
{
"$schema": "node_modules/@gentleduck/gen/duck-gen.schema.json",
"framework": "nestjs",
"extensions": {
"shared": {
"includeNodeModules": false,
"outputSource": "./generated",
"sourceGlobs": ["src/**/*.ts", "src/**/*.tsx"],
"tsconfigPath": "./tsconfig.json"
},
"apiRoutes": {
"enabled": true,
"globalPrefix": "/api",
"normalizeAnyToUnknown": true,
"outputSource": ["./generated", "./src/generated"]
},
"messages": {
"enabled": true,
"outputSource": "./generated"
}
}
}
Add a message group tagged for Duck Gen:
/**
* @duckgen messages
*/
export const AuthMessages = [
'AUTH_SIGNIN_SUCCESS',
'AUTH_SIGNIN_FAILED',
] as const
Run the generator:
pnpm exec duck-gen
Import generated types (package outputs only exist when you don't set outputSource):
import type {
ApiRoutes,
DuckGenI18nMessages,
DuckgenScopedI18nByGroup,
} from '@gentleduck/gen/nestjs'
If you configure outputSource, import directly from your generated file instead:
import type { ApiRoutes } from './generated/duck-gen-api-routes'
Duck Gen writes type definitions to @gentleduck/gen/generated/<framework> and
exposes them via framework entrypoints like @gentleduck/gen/nestjs only when
no output paths are configured. If you set extensions.shared.outputSource,
extensions.apiRoutes.outputSource, or extensions.messages.outputSource, the
generator writes only to those configured paths (paths resolve relative to
duck-gen.json). When you customize outputs, import types from those files
directly instead of the package entrypoints.
Generated files include:
duck-gen-api-routes.d.tsduck-gen-messages.d.tsindex.d.tsduck-gen.json is missing, defaults are used.as const so keys are literal types.sourceGlobs are resolved relative to duck-gen.json and override tsconfig
includes for that extension when provided.sourceGlobs are provided, Duck Gen uses defaults:
**/*.controller.ts(x)**/*.ts(x)extensions.shared.sourceGlobs. If your
controllers don’t follow *.controller.ts(x), set
extensions.apiRoutes.sourceGlobs explicitly.node_modules, dist, generated, and
.turbo from globs unless includeNodeModules is true.tsconfigPath is set, Duck Gen prefers tsconfig.duckgen.json (if it
exists) and falls back to tsconfig.json.FAQs
Type-safe API and message generator for TypeScript projects (NestJS-tested).
We found that @gentleduck/gen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.