
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@istanbuljs/schema
Advanced tools
Schemas describing various structures used by nyc and istanbuljs
const {nyc} = require('@istanbuljs/schema').defaults;
console.log(`Default exclude list:\n\t* ${nyc.exclude.join('\n\t* ')}`);
engines.node in package.json (currently >=8).node:test snapshot testing via t.assert.snapshot).npm test
To update snapshots:
npm run test:update-snapshots
@istanbuljs/schema for enterpriseAvailable as part of the Tidelift Subscription.
The maintainers of @istanbuljs/schema and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.
Joi is a powerful schema description language and data validator for JavaScript. Unlike @istanbuljs/schema, which is specific to IstanbulJS configuration schemas, Joi allows developers to define custom schemas for any purpose, making it more flexible for various validation needs.
Yup is another JavaScript schema builder for value parsing and validation. Similar to Joi, Yup provides a way to construct schemas for various types of data. It is often used in form validation. Compared to @istanbuljs/schema, Yup offers more general-purpose functionality rather than being tailored to a specific library's configuration.
FAQs
Schemas describing various structures used by nyc and istanbuljs
The npm package @istanbuljs/schema receives a total of 41,912,416 weekly downloads. As such, @istanbuljs/schema popularity was classified as popular.
We found that @istanbuljs/schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.