
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@gentleduck/ttest
Advanced tools
🦆 @gentleduck/ttestTypeScript Type-Level Test Framework. Assert your types like you mean it, at compile time.
ttest is a zero-runtime library for writing type-level tests in TypeScript.
You spend countless hours designing complex types and systems, ttest gives you a way to validate them with confidence. No console.log, no runtime hacks, just pure type assertion at compile-time.
tsc, tsd, vitest + @ts-expect-error)pnpm add -D @gentleduck/ttest
# or
npm install --save-dev @gentleduck/ttest
type Schema = InferSchema<"CREATE TABLE users (id INT PRIMARY KEY, email TEXT NOT NULL)">;
type Test_Column = AssertTrue<
Equal<Schema['email'], string>,
'Expected SQL "TEXT" to infer as string'
>;
tsd or expect-type?@gentleduck/ttest is inspired by them but designed for framework authors and type-heavy codebases:
type X1 = XOR<{ a: number; common: string }, { b: boolean; common: string }>
// expected: { a: number } | { b: boolean }
type Test_X1 = AssertTrue<
Equal<X1, { a: number } | { b: boolean }>,
'Expected XOR to produce mutually exclusive union of properties'
>;
Runtime tests test behavior. Type tests test contracts.
If you’re building a schema system, compiler, or framework, types are your architecture. You can’t trust what you can’t test. @gentleduck/ttest exists to close the feedback loop between your types and your logic.
FAQs
Compile-time type testing utilities for TypeScript
We found that @gentleduck/ttest demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.