
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@magijs/plugin-constraint
Advanced tools
export default {
strict: {},
};
所有规则是默认开启的,但以下规则除外
FILES_ALL_TYPESCRIPT
如有需要,可通过 strict.rules 开启
export default defineConfig({
strict: {
rules: {
FILES_ALL_TYPESCRIPT: true,
},
},
});
原则上不允许禁用规则
执行 magi constraint 命令
magi 版本不允许写死,只能使用 ^ 前缀。
// bad
"@magi/magi": "1.0.0"
// still bad
"@magi/magi": "~1.0.0"
// good
"@magi/magi": "^1.0.0"
如果出于某些原因使用了 beta 版,也需使用 ^ 前缀保证正式版发布后能自动匹配到。
// bad
"@magi/magi": "1.0.0-beta.1"
// good
"@magi/magi": "^1.0.0-beta.1"
"@magi/magi": "^1.0.0-0"
FAQs
## 开启、禁用和检查状态
The npm package @magijs/plugin-constraint receives a total of 1 weekly downloads. As such, @magijs/plugin-constraint popularity was classified as not popular.
We found that @magijs/plugin-constraint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.