
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
capnp-js-plugin
Advanced tools
Generate Javascript serialization classes for Capnproto.
Installation and preferred use
npm install capnp-js-plugin.npm install -g capnp-js-plugin.devDependency: npm install --save-dev capnp-js-plugin.dependency, because this would result in absurdly long build times for non-dev users.Usage
capnp compile -ojs someSchema.capnp to generate a someSchema.capnp.d directory that contains the schema's AMD files.capnp help compile for additional options.This plugin generates serialization classes similar to those of the c++ reference implementation.
Given a schema someSchema.capnp, capnp compile -ojs someSchema.capnp will generate someSchema.capnp.d/readers.js, someSchema.capnp.d/builders.js, and some internal files:
Javascript implementation of readers for members of someSchema.capnp. See Readers from the reference implementation's documentation.
Javascript implementation of builders for members of someSchema.capnp. See Builders from the reference implementation's documentation.
The following files exist under someSchema.capnp.d/, but should not be imported by user code. These files facilitate circular reference resolution by creating types and accumulating them, without calling any prototype methods.
The Javascript plugin maps absolute imports to absolute AMD paths. Consider the messaging example from the rtc-github repository:
using import "/rtc-github-protocol/user.capnp".User;.capnp compile -ojs -I node_modules/ capnp/*.capnp, yields an absolute path in capnp/server.capnp.d/readers.js, amongst others.So why the /rtc-github-protocol prefix?
Why not using import "/user.capnp".User;, capnp compile -ojs -I ./node_modules/rtc-github-protocol/ capnp/*.capnp, and then provide a user.capnp.d path to the AMD loader?
Nfy doesn't remap absolute names.
If I need to use capnp/server.capnp in a Node module, then every absolute path's root will need a corresponding entry under node_modules/.
This is no big deal if you're using npm link for these modules, but if you want to distribute under npm's official public registry (and don't want dependencies that point at git repositories), then publishing user.capnp.d seems wrong.
The schemas under /rtc-github-protocol are used by an RTC signaling server that will probably appear on npm's official public registry someday, hence the /rtc-github-protocol prefix.
You should minify the generated code for production builds.
The generated code contains console.warn calls for development purposes--use something like uglifyjs -c drop_console to eliminate them.
FAQs
Capnproto implementation for Javascript
We found that capnp-js-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.