
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This is a CLI tool to convert JSDoc annotations into standard Flow type annotations. This means:
// Converts this:
/**
* @param {Foobar[]} bar A foobar array
* @param {Function} baz
* @return {number}
*/
function foo(bar, baz) {
return 42;
}
// Into this:
/**
* @param {Foobar[]} bar A foobar array
* @param {Function} baz
* @return {number}
*/
function foo(bar: Array<Foobar>, baz: Function) : number {
return 42;
}
Furthermore, a short in-line style is also supported:
// Converts this:
//: (string, number) : Object
function foo(a, b) {
return {};
}
// Into this:
function foo(a: string, b: number) : Object {
return {};
}
// NB: The ":" at the start of the comment is REQUIRED.
// NBB: The in-line comment is REMOVED in the output to avoid Flow re-interpreting it..
The goal of this project is to make type checking as easy as running a linter, so you can take any project and run the following to get type errors:
$ flow-jsdoc -d ./lib -o ./annotated
$ flow check --all ./annotated
This tool will NOT apply /* @flow */ to the file. You still need to do that!
$ npm install -g flow-jsdoc
$ flow-jsdoc -f path/to/file.js
# annotated file prints to stdout
$ flow-jsdoc -d path/to/lib -o path/to/output
# every file in path/to/lib is processed and output to path/to/output (directory structure preserved)
var flowJsdoc = require("flow-jsdoc");
var fileContents = // extract your file contents e.g. via 'fs' - this should be a string
var opts = {
// no options yet!
};
var annotatedContents = flowJsdoc(fileContents, opts);
// write out annotated contents to file
Currently, this tool will only work on functions and ES6 classes. It will handle functions represented in the following ways:
function foo(bar) {}var foo = function(bar) {}var obj = { foo: function(bar) {} }ObjClass.prototype.foo = function(bar) {} - ES5 Classesclass ObjClass { foo(bar) {} } - ES6 Classes(foo, bar) => { } - ES6 "fat arrow" functionsFor each recognised function, the JSDoc tags @param and @return will be mapped to Flow annotations. This will currently do the following mappings from JSDoc to Flow:
{AnyThingHere} => : AnyThingHere (Name expressions){String[]} => : Array<String> (Type applications){*} => : any (Any type){Object|String} => : Object | String (Type unions){string=} => : ?string (Optional params){?string} => : ?string (Nullable types)ES6 classes will include field declarations via the @prop and @property tags like so:
// Converts this ES6 Class:
class Foo {
/**
* Construct a Foo.
* @property {string} bar
* @prop {number} baz
*/
constructor(bar, baz) {
this.bar = bar;
this.baz = baz;
}
}
// Into this:
class Foo {
bar: string;
baz: number;
/**
* Construct a Foo.
* @property {string} bar
* @prop {number} baz
*/
constructor(bar, baz) {
this.bar = bar;
this.baz = baz;
}
}
This tool will then produce the whole file again with flow annotations included (JSDoc preserved).
There are plans for this tool to (roughly in priority order):
{{a: number, b: string, c}}@typedef@callback sensibly)FAQs
Represent flow type annotations with JSDoc syntax
The npm package flow-jsdoc receives a total of 96 weekly downloads. As such, flow-jsdoc popularity was classified as not popular.
We found that flow-jsdoc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.