Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@microsoft/decorators
Advanced tools
This package defines a conservative set of decorators intended for use in both NodeJS and web browser projects. We recognize that decorators have certain risks:
They can inject hidden code at runtime, causing confusion for developers who expected the source code to follow conventional semantics
They can be difficult to debug, since decorators are evaluated at load time (versus compile time or run time)
They can affect API contracts in subtle ways, which may cause unforeseen breaks for runtime versioning (e.g. when loading a subclass that was compiled against an older version of a base class with decorators)
The decorator spec is still evolving, and there may be breaking changes in the future
In this light, the @microsoft/decorators package provides a small set of decorators that stay within the conventional semantics of the TypeScript language. The intent is to document API contracts more clearly and catch common mistakes, NOT to provide an open-ended toolkit of creative macros. (If you are looking for that, there are many other options, for example the core-decorators project.)
This package is part of the SharePoint Framework, which is a collection of NPM packages that empower developers to create client-side experiences for Microsoft SharePoint. For more information, including complete API documentation and code samples, please visit the SharePoint Framework web site.
FAQs
A very conservative set of decorators for TypeScript projects
The npm package @microsoft/decorators receives a total of 7,222 weekly downloads. As such, @microsoft/decorators popularity was classified as popular.
We found that @microsoft/decorators demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.