
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@time-provider/core
Advanced tools
Time-Provider : Core library ~ Your single time interface for all your JavaScript / TypeScript projects.
Code coupled to the native Date object, Temporal objects, any specific date library, or the
environment's scheduler (setTimeout, setInterval) has an implicit
dependency on the system clock. That's what pushes teams toward global
fake-timer libraries for testing - patching Date/timers process-wide,
which affects unrelated code and makes tests harder to reason about.
vs. jest.useFakeTimers() / sinon.useFakeTimers(): scoped per call site, no global patch, no restore/cleanup step.
time-provider makes time an explicit, injectable dependency instead: a
single object exposing a clock, a parser, a scheduler, and a performance API swappable per
call site.
Note: The animation-frame API is available as an addon.
setTimeout/setInterval driven by the clock strategy, not the real event loop, so manual/sequential/fixed runs are synchronous and don't depend on wall-clock time.Date. Your code keeps working with the date type it already uses.Date, plain Moment.js are UTC-only - see ARCHITECTURE.md) - withTimezone(...) plus localNow()/utcNow().@time-provider/core.npm install @time-provider/core @time-provider/plugin-native
Swap plugin-native for plugin-dayjs, plugin-luxon, plugin-moment, plugin-moment-timezone, or plugin-temporal depending on the date library you use.
// production: import the default production runtime
import { createTimeProvider } from "@time-provider/core";
import { plugin } from "@time-provider/plugin-native";
// create a production runtime
const timeProvider = createTimeProvider.for(plugin).create();
class UserService {
constructor(private readonly timeProvider: ITimeProvider<Date>) {}
createUser() {
return { createdAt: this.timeProvider.clock.utcNow() };
}
}
// test: import the deterministic runtime
import { createTimeProvider } from "@time-provider/core/deterministic";
import { plugin } from "@time-provider/plugin-native/deterministic";
// create a deterministic runtime
const timeProvider = createTimeProvider
.for(plugin)
.asManual()
.withInitialTime("2026-01-01T00:00:00.000Z")
.create();
let retries = 0;
timeProvider.scheduler.setInterval(() => retries++, 1000);
timeProvider.clock.advance({ seconds: 3 });
expect(retries).toBe(3);
Every time provider exposes the same four-part surface:
interface ITimeProvider<TDate> {
clock: IClock<TDate>; // localNow, utcNow, timestampNow, withTimezone
parser: IParser<TDate>; // parseToUtc, parseToLocal
scheduler: IScheduler; // setTimeout, setInterval, setRecurring (+ the matching clear*)
performance: IPerformance; //now, getEntries, measure,...
}
Animation-Frame API comes with its addon that extends ITimeProvider with:
interface ITimeProvider<TDate> {
animation: IAnimationFrameScheduler; //requestAnimationFrame, cancelAnimationFrame
}
| Strategy | Behavior | Typical use |
|---|---|---|
| System | Real time, real timers | Production |
| Fixed | Always the same instant | Deterministic single-instant tests |
| Manual | Advances only when told to | Simulations, timer/retry logic tests |
| Sequential | Returns a predefined instant sequence | Tests asserting on changing timestamps |
createTimeProvider.for(plugin).asFixed().withFixedTime("2026-01-01T00:00Z").create();
createTimeProvider.for(plugin).asManual().withInitialTime("2026-01-01T00:00Z").create();
createTimeProvider
.for(plugin)
.asSequential()
.withSequentialTime("2026-01-01T00:01Z")
.withSequentialTime("2026-01-01T00:02Z")
.create();
Manual and sequential clocks run synchronously. A due
setTimeout/setIntervalcallback fires in-line, as a direct side effect of the call that made it due (advance(),localNow(),utcNow()) - not on a real event-loop tick. This is what makes them deterministic withoutawait, but it means call ordering can differ subtly from a real async run.
Within the scope of this library, these two terms refer to different concepts.
Date and plain Moment.js are UTC-only.packages/<name>/README.md) for adapter-specific notes.FAQs
Inject time. Control it in tests.
The npm package @time-provider/core receives a total of 15 weekly downloads. As such, @time-provider/core popularity was classified as not popular.
We found that @time-provider/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.