
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
babel-plugin-transform-metadata
Advanced tools
Reflection metadata support for classes and functions with flowtype type aliases support
Strict and smart reflection metadata generator for classes and functions from flowtype metadata.
flowtype and typescript reflection does not support type annotations as value keys, so we use some trick with typecast.
// @flow
import _ from 'babel-plugin-transform-metadata/_'
const id = (_: IT)
converted to:
// @flow
const id = 'IT'
// @flow
'use strict';
var _react = require('react');
function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
var B = function B() {
_classCallCheck(this, B);
};
var f = 123;
var A = function A(b, e, i, some) {
_classCallCheck(this, A);
};
dec2({ k: 'test' })(A, null, 1);
dec1(A, null, 0);
A._rdiArg = [B, 'IT', {
s: String,
b: V
}, f];
function ComponentD(rec, state, _t) {
return _t.h(
'div',
null,
'AA'
);
}
ComponentD._rdiDbg = 'babel-plugin-transform-metadata/src/__tests__/data/AllFeatures.js#ComponentD';
ComponentD._rdiJsx = true;
ComponentD._rdiArg = [{
s: Number
}];
function factory() {
return function () {};
}
factory._rdiDbg = 'babel-plugin-transform-metadata/src/__tests__/data/AllFeatures.js#factory';
factory._rdiFn = true;
function fn(a, b, f) {
function fn2(a) {}
}
fn._rdiDbg = 'babel-plugin-transform-metadata/src/__tests__/data/AllFeatures.js#fn';
fn._rdiFn = true;
fn._rdiArg = [A, B, factory];
var id = 'IT';
Add before babel-plugin-transform-decorators-legacy and other transformation plugins.
{
"plugins": [
"syntax-flow",
"transform-decorators-legacy",
["transform-metadata", {
"addDebugId": true,
"onlyExports": false,
"typeNameStrategy": "typeName",
"jsxPragma": "_t"
}]
]
}
For interface-based metadata we need to convert types to unique string tokens, something like this:
import type {T} from './types'
function test(t: T) {}
Reflection.defineMetadata(['T.types'], T)
JS module import subsystem is poor and nothing is doing in ES standarts for improving it. It's no clean way to identify imported interface in babel plugin, if import path is relative:
Types are same, but import paths is different:
import type {T} from './types'
import type {T} from '../data/types'
Ideally, set "typeNameStrategy": "fullPath" and always use absolute path for types via name_mapper in .flowconfig:
module.name_mapper='^babel-plugin-transform-metadata/i/\(.*\)' -> '<PROJECT_ROOT>/i/\1'
import type {T} from 'babel-plugin-transform-metadata/i/types'
import type {R} from './internalTypes'
function test(t: T, r: R) {}
Reflection.defineMetadata(['T.crc1', 'R.crc2'], test)
// where crc1 is crc32('babel-plugin-transform-metadata/i/types')
// where crc2 is crc32('internalTypes')
Relative paths supported, but some collisions possible, if types with equal names are defined in different files with equal names:
import type {T} from '../t2/internalTypes'
import type {T} from '../t1/internalTypes'
If "typeNameStrategy" is "fullPath", types always will be placed in separate files to avoid collisions like this:
// t1.js
export type T = {
some: string;
}
function test(t: T) {}
Reflection.defineMetadata(['T'], test)
// t2.js
import type {T} from './t2'
function test2(t: T) {}
Reflection.defineMetadata(['T.t2'], test2)
If "typeNameStrategy" is "typeName", import paths will be ignored. But possible collisions with equal type names in different files.
FAQs
Reflection metadata support for classes and functions with flowtype type aliases support
The npm package babel-plugin-transform-metadata receives a total of 50 weekly downloads. As such, babel-plugin-transform-metadata popularity was classified as not popular.
We found that babel-plugin-transform-metadata demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.