
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@types/retry
Advanced tools
TypeScript definitions for retry
npm install --save @types/retry
This package contains type definitions for retry (https://github.com/tim-kos/node-retry).
Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/retry.
These definitions were written by Stan Goldmann, and BendingBender.
Similar to 'retry', 'async-retry' provides retry functionality specifically designed for asynchronous operations. It supports both promise-based and async/await syntax, making it a good alternative for modern JavaScript and TypeScript applications. Unlike @types/retry, which is just type definitions, 'async-retry' is a standalone package that doesn't require separate type definitions.
This package is a promise-based retry library that offers a simple API for retrying operations. It is very similar to 'async-retry' but focuses more on promises. 'p-retry' is useful for applications heavily utilizing promises. It differs from @types/retry in that it's specifically designed for promise-based operations and also doesn't require separate type definitions for TypeScript users.
FAQs
TypeScript definitions for retry
The npm package @types/retry receives a total of 21,224,190 weekly downloads. As such, @types/retry popularity was classified as popular.
We found that @types/retry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.