Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@nozbe/microfuzz
Advanced tools
✨ Easily add power user-friendly search, autocomplete, jump to, command palette to your app.
microfuzz | |
---|---|
🤓 | Fuzzy search. Power users love it |
🗜️ | Tiny. 2KB gzipped |
✅ | Simple. Only a few options, reasonable defaults |
⚡️ | Fast. Filter thousands of items in milliseconds |
🧰 | Framework-agnostic. Plain JS, no dependencies |
⚛️ | React/React Native helpers (optional) included |
⚠️ | Static typing with Flow or TypeScript |
General idea of how microfuzz
works:
microfuzz
is not a one-size-fits-all solution (see Alternatives to consider).
import createFuzzySearch from '@nozbe/microfuzz'
const list = [/* an array of strings to fuzzy search */]
const fuzzySearch = createFuzzySearch(list)
// Run this whenever search term changes
// Only matching items will be returned, sorted by how well they match `queryText`
const results = fuzzySearch(queryText)
This is split into two steps for performance (createFuzzySearch
pre-processes list
, and you can cache/memoize function returned by it).
If list
is an array of objects:
const fuzzySearch = createFuzzySearch(list, {
// search by `name` property
key: 'name',
// search by `description.text` property
getText: (item) => [item.description.text]
// search by multiple properties:
getText: (item) => [item.name, item.description.text]
})
If you use React or React Native, you can use these optional helpers for convenience:
import { useFuzzySearchList, Highlight } from '@nozbe/microfuzz/react'
// `useFuzzySearchList` simply wraps `createFuzzySearch` with memoization built in
// NOTE: For best performance, `getText` and `mapResultItem` should be memoized by user
const filteredList = useFuzzySearchList({
list,
// If `queryText` is blank, `list` is returned in whole
queryText,
// optional `getText` or `key`, same as with `createFuzzySearch`
getText: (item) => [item.name],
// arbitrary mapping function, takes `FuzzyResult<T>` as input
mapResultItem: ({ item, score, matches: [highlightRanges] }) => ({ item, highlightRanges })
})
// Render `filteredList`'s labels with matching characters highlighted
filteredList.map(({ item, highlightRanges }) => (
<Item key={item.key}>
<Label><Highlight text={item.name} ranges={highlightRanges} /></Label>
</Item>
))
You can optionally pass { strategy: }
parameter to createFuzzySearch
/ useFuzzySearchList
:
'off'
- no fuzzy search, only matches if item contains query (or contains query words in any order)'smart'
- (default) matches letters in order, but poor quality matches are ignored'aggressive'
- matches letters in order with no restrictions (classic fuzzy search)I wrote microfuzz
simply because I didn't quite like how other fuzzy search libraries I found worked, for my use case. Your mileage may vary.
It's not the tiniest, the simplest, or the fastest implementation you can find. But it's tiny, simple, and fast enough, while providing fuzzy search heuristics and sorting that I found to work reasonably well in Nozbe, a project management app, where it's used to filter down or autocomplete lists of short labels — names of projects, sections, tasks, user names, etc.
By "fast" I mean that on my computer, with a list of ~4500 labels, the first search (one-letter search query) takes ~7ms, while subsequent searches take less than 1.5ms — all in-memory, without indexing. More than fast enough to search on every keystroke without any lag.
If you have much larger lists to fuzzy-search, you may find the performance unsatisfactory — consider implementations with simpler heuristics or indexing. For very long strings (notes, comments), fuzzy-searching may not be the right strategy — consider Full-Text Search (with indexing) instead.
Feel free to contribute improvements to sorting heuristics or alternative search strategies (provided that the "fast, simple, tiny" criteria don't suffer too much).
Alternatives:
microfuzz was created by @Nozbe.
microfuzz's main author and maintainer is Radek Pietruszewski (website ⋅ twitter ⋅ engineering posters)
microfuzz is available under the MIT license. See the LICENSE file for more info.
FAQs
A tiny, simple, fast fuzzy search library
The npm package @nozbe/microfuzz receives a total of 8,459 weekly downloads. As such, @nozbe/microfuzz popularity was classified as popular.
We found that @nozbe/microfuzz demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.