
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A lightweight, decorator-based lifecycle and dependency injection framework for TypeScript applications.
# Using npm
npm install app-leaf
# Using Bun
bun add app-leaf
When using controllers, always use regular imports rather than type-only imports:
import type { SomeController } from "./SomeController"; // BAD: Will cause errors during dependency injection
import { SomeController } from "./SomeController"; // GOOD: Ensures proper controller registration
Type-only imports prevent the controller class from being registered properly in the dependency injection system.
import { Controller, OnInit, OnStart, AppLeaf } from "app-leaf";
@Controller()
class HelloController {
@OnInit()
private init() {
console.log("HelloController initialized");
}
@OnStart()
private start() {
console.log("HelloController started");
}
sayHello() {
return "Hello, world!";
}
}
@Controller()
class AppController {
constructor(private readonly helloController: HelloController) {}
@OnStart()
private start() {
console.log(this.helloController.sayHello());
}
}
// Start the application lifecycle
AppLeaf.Start();
import { Controller, Module, AppLeaf } from "app-leaf";
@Controller()
class UserController {
getUsers() {
return ["User1", "User2"];
}
}
@Controller()
class ProductController {
getProducts() {
return ["Product1", "Product2"];
}
}
@Module([UserController, ProductController])
class FeatureModule {}
// To ensure all controllers are imported
AppLeaf.LoadModules([FeatureModule]);
AppLeaf.Start();
@Controller({ loadOrder: 1 })
class FirstController {}
@Controller({ loadOrder: 2 })
class SecondController {}
import { Controller, OnStart, Dependency, AppLeaf } from "app-leaf";
@Controller()
class ServiceController {
getData() {
return "Service Data";
}
}
@Controller()
class ConsumerController {
@OnStart()
private start() {
// Get controller reference after initialization
const service = Dependency(ServiceController);
console.log(service.getData());
}
}
AppLeaf.Start();
@Controller(options?: { loadOrder?: number })Registers a class as a controller in the application lifecycle.
loadOrder: Optional number that determines initialization order (lower values initialize first)@OnInit()Marks a method to be called during the initialization phase, before dependency injection.
@OnStart()Marks a method to be called after all controllers are initialized and injected.
@Module(controllers: any[])Registers a class as a module containing a list of controllers.
Dependency<T>(controllerClass: new (...args: any) => T): TGets an instance of a registered controller after initialization.
OnStart methods or after AppLeaf.Start()AppLeaf.LoadModules(modules: any[])Ensures that all controllers in the provided modules are imported.
AppLeaf.Start()Starts the application lifecycle:
loadOrderOnInit methodsOnStart methods in parallelFAQs
A brief description of my npm package.
The npm package app-leaf receives a total of 0 weekly downloads. As such, app-leaf popularity was classified as not popular.
We found that app-leaf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.