Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
eslint-plugin-zod-to-openapi
Advanced tools
This package is intended to be public on seek-oss.
To create an internal package,
run skuba init
and select the private-npm-package
template.
Next steps:
log
Writes the module name to stdout. Thrilling stuff.
import { log } from 'eslint-plugin-zod-to-openapi';
log();
yarn install
yarn test
# Fix issues
yarn format
# Check for issues
yarn lint
# Compile source
yarn build
# Review bundle
npm pack
This package is published to the public npm registry with a GitHub Actions release workflow.
The workflow runs on select branches:
on:
push:
branches:
# add others as necessary
- beta
- master
# - alpha
It depends on this repo being hosted on seek-oss with appropriate access.
To set up this repo for publishing, follow the instructions in our OSS npm package guidance.
This package is published with semantic-release, which requires a particular commit format to manage semantic versioning.
You can run the interactive yarn commit
command in place of git commit
to generate a compliant commit title and message.
If you use the Squash and merge
option on pull requests, take extra care to format the squashed commit in the GitHub UI before merging.
Commits to the master
branch will be released with the latest
tag,
which is the default used when running npm install
or yarn install
.
semantic-release prescribes a branch-based workflow for managing distribution tags.
You can push to other branches to manage betas, maintenance updates to prior major versions, and more.
Here are some branches that semantic-release supports by default:
Git branch | npm dist-tag |
---|---|
master | latest |
alpha | alpha |
beta | beta |
next | next |
1.x | release-1.x |
For more information, see the semantic-release docs on triggering a release.
FAQs
Eslint rules for zod-to-openapi
The npm package eslint-plugin-zod-to-openapi receives a total of 58 weekly downloads. As such, eslint-plugin-zod-to-openapi popularity was classified as not popular.
We found that eslint-plugin-zod-to-openapi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.