Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
JavaScript dependency injection like Autofac in .Net
You have an interface (base/abstract class) and its implementation (derived class)
user-repository.js
export class UserRepository {
constructor() {
if (new.target === UserRepository) {
throw new TypeError('Cannot construct UserRepository instance directly');
}
}
list() {
throw new Error("Not implemented");
}
getById(userId) {
throw new Error("Not implemented");
}
}
fake-user-repository.js
import { UserRepository } from './user-repository';
export class FakeUserRepository extends UserRepository {
constructor() {
super();
this.users = [
{
id: 1,
name: 'user-1'
},
{
id: 2,
name: 'user-2'
},
];
}
list() {
return this.users;
}
getById(userId) {
return this.users.find(user => user.id === userId);
}
}
There is simple logger.
logger.js
export class Logger {
debug(message) {
throw new Error("Not implemented");
}
}
console-logger.js
import { Logger} from './logger';
export class ConsoleLogger extends Logger {
constructor(prefix) {
super();
this.prefix = prefix;
}
debug(message) {
console.log(`${this.prefix}: ${message}`);
}
}
You have the repository consumer.
To allow DI container inject dependencies in your consumer class you should specify __dependencies
static property.
That property should contain constructor array in the order of your constructor.
user-service.js
import { Logger } from './logger';
import { UserRepository } from './user-repository';
export class UserService {
static __dependencies = [ UserRepository, Logger ];
constructor(userRepository, logger) {
this.userRepository = userRepository;
this.logger = logger;
}
list() {
this.logger.debug('Access to users list');
return this.userRepository.list();
}
get(userId) {
return this.userRepository.getById(userId);
}
}
Dependency registration
some-config.js
import { container } from 'cheap-di';
import { ConsoleLogger} from './console-logger';
import { FakeUserRepository } from './fake-user-repository';
import { Logger} from './logger';
import { UserRepository } from './user-repository';
container.registerType(ConsoleLogger).as(Logger).with('most valuable message prefix');
container.registerType(FakeUserRepository).as(UserRepository);
To get instance of your service with injected parameters you should call resolve
method.
some-place.js
import { container } from 'cheap-di';
import { UserService } from './user-service';
const service = container.resolve(UserService);
const users = service.list();
logger.ts
export abstract class Logger {
abstract debug: (message: string) => void;
}
console-logger.ts
import { Logger} from './logger';
export class ConsoleLogger extends Logger {
constructor(prefix) {
super();
this.prefix = prefix;
}
debug(message: string) {
console.log(`${this.prefix}: ${message}`);
}
}
@dependencies
decorator can be used to simplify dependency syntax
user-service.ts
import { dependencies } from 'cheap-di';
import { Logger } from './logger';
import { UserRepository } from './user-repository';
@dependencies(UserRepository, Logger)
export class UserService {
constructor(
private userRepository: UserRepository,
private logger: Logger
) {
}
list() {
this.logger.debug('Access to users list');
return this.userRepository.list();
}
get(userId) {
return this.userRepository.getById(userId);
}
}
You can see more examples in cheap-di/src/container.test.ts
FAQs
Easy way to create nice web routes for you application
The npm package cheap-di receives a total of 94 weekly downloads. As such, cheap-di popularity was classified as not popular.
We found that cheap-di demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.