
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@openfn/compiler
Advanced tools
Functions and utilities to compile and analyse code.
The primary job of the compiler right now is to take job DSL code and convert it into JS which can be executed by the runtime.
A simple CLI parser utility is provided.
You can pass a string of Javascript and it will output an AST tree to stdout.
Pass -s for a simplified tree (way easier to read!), -o path/to/output.json, -e to eval the input (otherwise it'll be treated as a path)
$ pnpm parse -s -e "fn();"
If writing tests against ast trees, you can pass the -t flag with a test name. The resulting tree will be output to test/asts/{name}.json without prettification.
$ pnpm parse -t "my-test" /tmp/my-test.js
TODO
It can be pretty hard to understand what the parse trees look like.
The basic spec is here: https://github.com/estree/estree/blob/master/es2015.md
You have to check the parent folder for later language extensions.
The compiler can inject imports for a specific adaptor.
This requires the exports for the adaptor to be pre-loaded and appended to the options object. This is because the AST walked is synchronous, but fetching type definitions is an asynchronous task. [more details to follow]
There is a helper function preloadAdaptorExports in src/util to do this.
FAQs
Compiler and language tooling for openfn jobs.
The npm package @openfn/compiler receives a total of 534 weekly downloads. As such, @openfn/compiler popularity was classified as not popular.
We found that @openfn/compiler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.