
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@lcdev/api-fields
Advanced tools
A small utility package that enables an easy way to guarantee that your API doesn't return fields that you didn't want it to.
yarn add @lcdev/api-fields@0.1
You might want to reduce the duplication when extracting return values. Most of the time, you want to return the same fields for the same entities, records, etc.
API Fields is a decorator for classes that gives you the ability to tie in to @lcdev/mapper
,
specifically its extract
function.
import { ApiField } from '@lcdev/api-fields';
class User extends BaseEntity {
@ApiField()
id: number;
// we never want to give this back in API responses
// maybe it's private, or maybe we don't want consumers to depend on it
privateField: number;
@ApiField()
firstName: string;
// here, we only want the API Fields of Permission in the nested field
@ApiField(() => Permission)
permission: Permission;
...
}
To reveal the 'Extraction' object that can be used by @lcdev/mapper
:
import { getApiFields } from '@lcdev/api-fields';
import { extract } from '@lcdev/mapper';
// getApiFields can be called anywhere to retrieve the `Extraction` object
const extraction = getApiFields(User);
// use the mapper package to take back only the fields you're interested in
const trimmedFields = extract(fullFields, extraction);
Decorator possibilities:
@ApiField() property
means take all of property
@ApiField(() => PropertyType) property
means take ApiFields of property
@ApiField(() => [PropertyType]) property[]
means take ApiFields of all property
s@ApiField({ ... }) property
means take { ... }
from property
You might want to create middleware in your router to do this type of extraction for you. Internally at Launchcode we do just that, and would like to open-source that effort as well.
FAQs
Trim fields from your models before returning in API
The npm package @lcdev/api-fields receives a total of 6 weekly downloads. As such, @lcdev/api-fields popularity was classified as not popular.
We found that @lcdev/api-fields demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.