
Security News
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
@openflagsdev/js
Advanced tools
JavaScript/TypeScript SDK for OpenFlags — feature flags with local evaluation.
JavaScript/TypeScript SDK for OpenFlags. Fetches flags from the server and evaluates them locally (enabled, rollout percentage, user list).
In the monorepo: dependency on @openflagsdev/types. From outside, install @openflagsdev/js (when published).
import { createClient } from "@openflagsdev/js"
const client = await createClient({
apiUrl: "https://flags.example.com",
project: "my-app", // project slug or id from the dashboard
userId: "user-123", // optional; call client.identify(userId) when the user logs in or changes
})
if (client.isEnabled("new_checkout")) {
// show new checkout
}
const all = client.getAll() // { "new_checkout": true, "beta_ui": false }
// When the user logs in or changes (e.g. logout → identify(null))
client.identify("user-456")
client.identify(null) // clear user (anonymous)
GET {apiUrl}/projects/:project/flags. Returns a client with:
true if the flag is on for this user (respects rollout % and explicit user list).Record<flagKey, boolean> for all flags.null to clear (e.g. logout). Evaluation uses the new user on the next call.Config: apiUrl, project (slug or id from the dashboard), userId (optional).
bun run build — Compile TypeScript to dist/bun test — Run testsFlag shapes and evaluation rules come from @openflagsdev/types.
FAQs
JavaScript/TypeScript SDK for OpenFlags — feature flags with local evaluation.
We found that @openflagsdev/js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.