
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
@valencets/valence
Advanced tools
<source media="(prefers-color-scheme: dark)" srcset="./assets/logo-dark-animated.png"> <source media="(prefers-color-scheme: light)" srcset="./assets/logo-light-animated.png"> <img alt="Valence" src="./assets/log
Schema-driven full-stack framework for Node.js and PostgreSQL.
Define collections and fields in one TypeScript config. Valence derives the database tables, admin UI, REST API, typed frontend scaffold, entity codegen, page routing, first-party analytics, validators, and migrations from that single schema. No plugins. No vendor scripts. Minimal, audited dependencies.
// valence.config.ts
import { defineConfig, collection, field } from '@valencets/valence'
export default defineConfig({
db: {
host: process.env.DB_HOST ?? 'localhost',
port: Number(process.env.DB_PORT ?? 5432),
database: process.env.DB_NAME ?? 'mysite',
username: process.env.DB_USER ?? 'postgres',
password: process.env.DB_PASSWORD ?? ''
},
server: { port: Number(process.env.PORT ?? 3000) },
collections: [
collection({
slug: 'posts',
labels: { singular: 'Post', plural: 'Posts' },
fields: [
field.text({ name: 'title', required: true }),
field.slug({ name: 'slug', slugFrom: 'title', unique: true }),
field.richtext({ name: 'body' }),
field.boolean({ name: 'published' }),
field.date({ name: 'publishedAt' })
]
}),
collection({
slug: 'users',
auth: true,
fields: [
field.text({ name: 'name', required: true }),
field.select({ name: 'role', defaultValue: 'editor', options: [
{ label: 'Admin', value: 'admin' },
{ label: 'Editor', value: 'editor' }
]})
]
})
],
admin: { pathPrefix: '/admin', requireAuth: true },
telemetry: {
enabled: true,
endpoint: '/api/telemetry',
siteId: 'mysite'
}
})
That config gives you: posts and users tables in Postgres, a server-rendered admin panel with form validation and session auth (Argon2id), a REST API at /api/posts and /api/users, a typed src/ scaffold with entity interfaces and API clients, Zod validators, database migrations, and a first-party analytics pipeline that tracks user intent without any third-party scripts on your public pages. Change the schema, everything follows.
npx @valencets/valence init my-site
cd my-site
pnpm dev
The init wizard walks you through:
admin)Init also generates a src/ directory with Feature-Sliced Design structure, typed entity interfaces, and API clients derived from your collections. Pass --yes to skip prompts and accept defaults (useful for CI).
Open http://localhost:3000/admin to sign in. Open http://localhost:3000 for the landing page.
/admin. Server-rendered HTML forms, CSRF protection, session auth with Argon2id. Login page with proper error handling./api/:collection. CRUD with Zod validation, parameterized queries, Result<T, E> error handling.valence init generates src/ with Feature-Sliced Design: app/, pages/, entities/, features/, shared/.// @generated files regenerate on config change; user-edited files are never overwritten.public/ served with MIME types and path traversal protection.src/pages/ maps to URL paths. List + detail page templates scaffold per collection.valence.config.ts during dev and entity types and API clients regenerate automatically.<link>, <meta>, <script> tags into the admin <head> via config.valence dev that teaches core concepts through real actions. Run valence init --learn to try it.Valence includes a complete, privacy-respecting analytics pipeline that runs entirely on your own infrastructure. No Google Analytics, no Plausible, no third-party scripts on your public pages. Your data stays in your Postgres.
How it works:
Annotate HTML elements with data-telemetry-* attributes:
<button data-telemetry-type="CLICK" data-telemetry-target="hero.cta">
Get Started
</button>
The client library captures user intent events in a pre-allocated ring buffer (zero allocation in the hot path) and auto-flushes via navigator.sendBeacon() every 30 seconds.
The server ingests beacon payloads, stores raw events, and aggregates them into daily summaries -- sessions, pageviews, conversions, top pages, top referrers, device breakdowns.
View it all in the built-in analytics dashboard at /admin/analytics.
11 intent types beyond simple pageviews: CLICK, SCROLL, VIEWPORT_INTERSECT, FORM_INPUT, INTENT_NAVIGATE, INTENT_CALL, INTENT_BOOK, INTENT_LEAD, LEAD_PHONE, LEAD_EMAIL, LEAD_FORM. This means you can track conversion-oriented actions (calls, bookings, form submissions) natively, not just clicks.
Architecture: The telemetry pipeline spans two packages. @valencets/core handles client-side capture (ring buffer, event delegation, beacon flush). @valencets/telemetry handles server-side ingestion, validation, daily aggregation, and query functions (getDailyTrend, getDailyBreakdowns). The CMS admin panel consumes these queries to render the dashboard.
| Package | What it does | External deps |
|---|---|---|
| @valencets/ui | 18 Web Components. ARIA, i18n, telemetry hooks, hydration directives. OKLCH design tokens. | none |
| @valencets/core | Router + server. pushState nav, fragment swaps, prefetch, view transitions, server islands. | neverthrow |
| @valencets/db | PostgreSQL query layer. Tagged template SQL, parameterized queries, Result<T,E>, migration runner. | postgres, neverthrow, zod |
| @valencets/cms | Schema engine. collection() + field.* produces tables, validators, REST API, admin UI, auth, media. Rich text via Lexical. | lexical, argon2, zod, neverthrow |
| @valencets/telemetry | Beacon ingestion, event storage, daily summaries, fleet aggregation. | postgres, neverthrow |
| @valencets/valence | CLI + FSD scaffold + entity codegen. valence init, valence dev, valence migrate, valence build. | tsx, zod, neverthrow |
Total external runtime deps: 6 — postgres, neverthrow, zod, lexical, argon2, tsx. All MIT-licensed, all audited via Socket.
Browser JS: Public-facing pages ship zero third-party JavaScript. The admin panel uses Lexical (Meta, MIT, ~40kB gzipped) for rich text editing only.
| Rule | Why |
|---|---|
| Complexity < 20 | Every function fits on one screen. No exceptions. |
Result<T, E> everywhere | If it can fail, the type signature says so. Both branches handled or it doesn't compile. |
| 14kB critical shell | First paint in the first TCP data flight. CDN-ready with cache profiles and server islands. |
| Pre-allocated ring buffer | Zero allocation in the telemetry hot path. |
| Zero third-party JS on public pages | Your site ships your code. Lexical is admin-only. Nothing phones home. |
| 1,547 tests | Strict TypeScript, neostandard, CI on every push. |
git clone https://github.com/valencets/valence.git
cd valence
pnpm install
pnpm build
pnpm test
See CONTRIBUTING.md for standards and the TDD workflow.
MIT
FAQs
<source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/valencets/valence/master/assets/logo-dark-animated.png"> <source media="(prefers-color-scheme: light)" srcset="https://raw.github
The npm package @valencets/valence receives a total of 1,384 weekly downloads. As such, @valencets/valence popularity was classified as popular.
We found that @valencets/valence demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.