
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
express-validate-kit
Advanced tools
一个轻量级的 Express 请求验证工具包,支持多种验证库,包括 Joi、Yup、Zod 和 Valibot。
npm install express-validate-kit
# 同时安装你需要的验证库
npm install joi # 如果使用 Joi
npm install yup # 如果使用 Yup
npm install zod # 如果使用 Zod
npm install valibot # 如果使用 Valibot
如果你想使用自定义验证逻辑,可以直接使用核心 API:
import express from 'express'
import { createValidator } from 'express-validate-kit'
const app = express()
app.use(express.json())
app.use(express.urlencoded({ extended: true }))
// 创建自定义验证器
const validator = createValidator(
{
query: {
page: val => {
const nVal = parseInt(val)
if (isNaN(nVal)) throw new Error('page is invalid')
if (nVal < 1) throw new Error('page can not be less than 1')
return nVal
},
size: val => {
const nVal = parseInt(val)
if (isNaN(nVal)) throw new Error('size is invalid')
if (nVal < 1) throw new Error('size can not be less than 1')
if (nVal > 20) throw new Error('size can not be greater than 20')
return nVal
},
name: val => {
return val?.trim() ?? ''
}
}
},
(schema, value) => {
const data = {}
const error = []
for (const [key, validate] of Object.entries(schema)) {
try {
data[key] = validate(value[key])
} catch (err) {
error.push(err.message)
}
}
return {
data: error.length > 0 ? null : data,
error: error.length > 0 ? error : null
}
}
)
app.get('/users', validator, (req, res) => {
res.send({
query: req.query
})
})
import express from 'express'
import { joiValidator } from 'express-validate-kit/joi'
import joi from 'joi'
const app = express()
app.use(express.json())
app.use(express.urlencoded({ extended: true }))
app.put(
'/user/:id',
joiValidator(
{
params: joi.object({
id: joi.number().integer().min(1)
}),
body: joi.object({
name: joi.string().min(1).required()
})
},
{
validationOptions: {
allowUnknown: true
}
}
),
(req, res) => {
res.send({
body: req.body,
params: req.params
})
}
)
import express from 'express'
import { yupValidator } from 'express-validate-kit/yup'
import yup from 'yup'
const app = express()
app.use(express.json())
app.use(express.urlencoded({ extended: true }))
app.put(
'/user/:id',
yupValidator({
params: yup.object({
id: yup.number().integer().min(1).required()
}),
body: yup.object({
name: yup.string().min(1).required()
})
}),
(req, res) => {
res.send({
body: req.body,
params: req.params
})
}
)
import express from 'express'
import { zodValidator } from 'express-validate-kit/zod'
import { z } from 'zod'
const app = express()
app.use(express.json())
app.use(express.urlencoded({ extended: true }))
app.put(
'/user/:id',
zodValidator(
{
params: z.object({
id: z.coerce.number().int().min(1)
}),
body: z.object({
name: z.string({ message: 'name must be a string' }).min(1)
})
},
{
statusCode: 400
}
),
(req, res) => {
res.send({
body: req.body,
params: req.params
})
}
)
import express from 'express'
import { valibotValidator } from 'express-validate-kit/valibot'
import * as v from 'valibot'
const app = express()
app.use(express.json())
app.use(express.urlencoded({ extended: true }))
app.put(
'/user/:id',
valibotValidator(
{
params: v.object({
id: v.pipe(v.string(), v.transform(Number), v.number(), v.integer(), v.minValue(1))
}),
body: v.object({
name: v.pipe(v.string('name must be a string'), v.minLength(1))
})
},
{
statusCode: 400
}
),
(req, res) => {
res.send({
body: req.body,
params: req.params
})
}
)
createValidator(schemas, validateFn, options?)创建一个自定义验证中间件。
schemas: 包含 params、query 和/或 body 的对象,每个属性对应一个验证模式validateFn: 验证函数,接收模式和值,返回包含 data 和 error 的对象options: 可选配置
errorResponse: 自定义错误响应函数statusCode: 错误状态码joiValidator(schemas, options?)创建一个 Joi 验证中间件。
schemas: 包含 Joi 验证模式的对象options: 可选配置
validationOptions: Joi 验证选项errorResponse: 自定义错误响应函数statusCode: 错误状态码createJoiValidator(options?)创建一个预配置的 Joi 验证器工厂函数。
yupValidator(schemas, options?)创建一个 Yup 验证中间件。
schemas: 包含 Yup 验证模式的对象options: 可选配置
validationOptions: Yup 验证选项errorResponse: 自定义错误响应函数statusCode: 错误状态码createYupValidator(options?)创建一个预配置的 Yup 验证器工厂函数。
zodValidator(schemas, options?)创建一个 Zod 验证中间件。
schemas: 包含 Zod 验证模式的对象options: 可选配置
errorResponse: 自定义错误响应函数statusCode: 错误状态码createZodValidator(options?)创建一个预配置的 Zod 验证器工厂函数。
valibotValidator(schemas, options?)创建一个 Valibot 验证中间件。
schemas: 包含 Valibot 验证模式的对象options: 可选配置
errorResponse: 自定义错误响应函数statusCode: 错误状态码createValibotValidator(options?)创建一个预配置的 Valibot 验证器工厂函数。
FAQs
一个轻量级的 Express 请求验证工具包,支持多种验证库,包括 Joi、Yup、Zod 和 Valibot。
We found that express-validate-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.