
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@oxdev03/node-tantivy-binding
Advanced tools
Node.js bindings for Tantivy. Provides indexing, querying, and advanced search features with TypeScript support.
Node.js bindings for Tantivy, the full-text search engine library written in Rust.
This project is a Node.js port of tantivy-py, providing JavaScript/TypeScript bindings for the Tantivy search engine. The implementation closely follows the Python API to maintain consistency across language bindings.
The bindings can be installed using npm:
npm install @oxdev03-org/node-tantivy-binding
If no binary is present for your operating system, the bindings will be built from source, which requires Rust to be installed.
For more detailed examples, see the tutorials.
import { SchemaBuilder, FieldType, Index, Document } from '@oxdev03-org/node-tantivy-binding'
// Create a schema
const schema = new SchemaBuilder()
.addTextField('title', { stored: true })
.addTextField('body', { stored: true })
.build()
// Create an index
const index = new Index(schema)
const writer = index.writer()
// Add documents
const doc1 = new Document()
doc1.addText('title', 'The Old Man and the Sea')
doc1.addText('body', 'He was an old man who fished alone in a skiff in the Gulf Stream.')
writer.addDocument(doc1)
writer.commit()
// Search
const searcher = index.searcher()
const query = index.parseQuery('sea', ['title', 'body'])
const results = searcher.search(query, 10)
console.log('Found', results.hits.length, 'results')
This Node.js binding provides access to most of Tantivy's functionality:
The API closely follows tantivy-py to maintain consistency:
Rust (required for building from source)Node.js@22+ which fully supports Node-APIyarn# Clone the repository
git clone <repository-url>
cd node-tantivy-binding-binding
# Install dependencies
npm install
# Build the native module
npm run build
# Run tests
npm test
The project includes a comprehensive test suite migrated from tantivy-py:
npm test
This library provides stable Node.js bindings for Tantivy, originally ported from tantivy-py. The core API is fully functional and covered by a comprehensive test suite.
The Node.js implementation differs from the Python version in several ways:
Current behavior: Node.js version accepts invalid values that Python rejects TODO: Implement strict validation to match Python behavior
// ❌ These currently PASS in Node.js but should FAIL:
Document.fromDict({ unsigned: -50 }, schema) // Should reject negative for unsigned
Document.fromDict({ signed: 50.4 }, schema) // Should reject float for integer
Document.fromDict({ unsigned: [1000, -50] }, schema) // Should reject arrays for single fields
Current behavior: Only accepts Buffer objects TODO: Support byte arrays like Python version
// ❌ These currently FAIL in Node.js but should PASS:
Document.fromDict({ bytes: [1, 2, 3] }, schema) // Should accept byte arrays
Document.fromDict(
{
bytes: [
[1, 2, 3],
[4, 5, 6],
],
},
schema,
) // Should accept nested arrays
Current behavior: Accepts primitive types for JSON fields
TODO: Restrict to objects/arrays only
// ❌ These currently PASS in Node.js but should FAIL:
Document.fromDict({ json: 123 }, schema) // Should reject numbers
Document.fromDict({ json: 'hello' }, schema) // Should reject strings
Current: Throws exception when field not configured as fast Python: Returns empty results TODO: Decide on consistent error handling approach
Current: Different error message formats TODO: Align error messages with Python version
Current: Uses getTime() timestamps Python: Uses datetime objects TODO: Consider more intuitive date API
Built with:
This project is heavily inspired by and based on:
MIT License - see LICENSE file for details.
FAQs
Node.js bindings for Tantivy. Provides indexing, querying, and advanced search features with TypeScript support.
We found that @oxdev03/node-tantivy-binding demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.