Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Transpiles Deno projects into .js
and .d.ts
for Node.js.
Uses ts-morph
to rewrite imports, typecheck, and emit.
Writing libraries Deno-first makes it easy to publish to https://deno.land/x, and simplifies development experience:
Deno [...] requires no explicit transpilation step, and ships with 0conf tooling that works well together.
$ deno run \
--no-check \
--unstable \
--allow-read \
--allow-write=<outDir> \
https://deno.land/x/deno2node/src/cli.ts \
<tsConfigFilePath>
As a by-product of end-to-end testing, Node.js build is also available:
$ npm install --save-dev --save-prefix='~' deno2node
$ deno2node <tsConfigFilePath>
tsconfig.json
is used to specify compilerOptions
and source files
to include
.
API reference explains transformations and configuration.
Note: output and diagnostics will change across minor versions.
To use Deno globals not available in Node.js, create and register a file exporting all the shims you need:
$ npm install deno.ns
// @filename: src/shim.node.ts
export * from "deno.ns";
// @filename: tsconfig.json
{
"deno2node": {
"shim": "src/shim.node.ts" // path to shim file, relative to tsconfig
}
}
When the provided transformations are not enough,
you can provide a Node-specific (<anything>.node.ts
)
and a Deno-specific (<anything>.deno.ts
) version of any file.
deno2node
will ignore the Deno version
and rewrite imports to use the Node.js version instead.
This technique has many uses.
deno2node
uses it to import from https://deno.land/x.
grammy
will probably also use it to abstract away platform-specific APIs.
If you import a module which has no npm equivalent,
deno2node
will vendor it in vendorDir
, if specified:
// @filename: tsconfig.json
{
"deno2node": {
"vendorDir": "src/.deno2node/vendor/" // path within `rootDir`
}
}
Vendoring requires --allow-env
, to locate Deno cache.
Note: vendoring is currently slow and poorly tested.
Consider recommending pnpm
to users of your library.
It might be able to deduplicate vendored files across packages.
FAQs
`tsc` replacement for transpiling Deno libraries to run on Node.js.
The npm package deno2node receives a total of 1,268 weekly downloads. As such, deno2node popularity was classified as popular.
We found that deno2node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.