Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
flow-remove-types
Advanced tools
Removes Flow type annotations from JavaScript files with speed and simplicity.
The flow-remove-types npm package is a tool designed to strip Flow type annotations from JavaScript code. This is useful for projects that use Flow for type checking but need to remove the type annotations for production builds or for compatibility with environments that do not support Flow.
Remove Flow Types from JavaScript Code
This feature allows you to remove Flow type annotations from a string of JavaScript code. The input code contains Flow type annotations, and the output will be the same code without the type annotations.
const flowRemoveTypes = require('flow-remove-types');
const input = '/* @flow */\nfunction square(n: number): number {\n return n * n;\n}';
const output = flowRemoveTypes(input);
console.log(output.toString());
Remove Flow Types from Files
This feature allows you to remove Flow type annotations from a JavaScript file. The input file contains Flow type annotations, and the output file will be the same code without the type annotations.
const fs = require('fs');
const flowRemoveTypes = require('flow-remove-types');
const inputFilePath = 'path/to/input.js';
const outputFilePath = 'path/to/output.js';
const inputCode = fs.readFileSync(inputFilePath, 'utf8');
const output = flowRemoveTypes(inputCode);
fs.writeFileSync(outputFilePath, output.toString());
babel-plugin-transform-flow-strip-types is a Babel plugin that removes Flow type annotations from JavaScript code. It integrates with the Babel ecosystem, making it a good choice for projects that already use Babel for transpilation. Compared to flow-remove-types, this plugin is more suitable for projects that use Babel as part of their build process.
TypeScript is a superset of JavaScript that adds static types. While it is not a direct replacement for Flow, it provides similar type-checking capabilities. TypeScript has its own compiler that removes type annotations, similar to how flow-remove-types works for Flow. However, adopting TypeScript usually involves a more significant change to the codebase compared to using Flow.
Turn your JavaScript with Flow type annotations into standard JavaScript in an instant with no configuration and minimal setup.
Flow provides static type checking to JavaScript which can both help find and detect bugs long before code is deployed and can make code easier to read and more self-documenting. The Flow tool itself only reads and analyzes code. Running code with Flow type annotations requires first removing the annotations which are non-standard JavaScript. Typically this is done via adding a plugin to your Babel configuration, however Babel may be overkill if you're only targeting modern versions of Node.js or just not using the modern ES2015 features that may not be in every browser.
flow-remove-types
is a faster, simpler, zero-configuration alternative with
minimal dependencies for super-fast npm install
time.
Use the command line:
npm install --global flow-remove-types
flow-remove-types --help
flow-remove-types input.js > output.js
Or the JavaScript API:
npm install flow-remove-types
var flowRemoveTypes = require('flow-remove-types');
var fs = require('fs');
var input = fs.readFileSync('input.js', 'utf8');
var output = flowRemoveTypes(input);
fs.writeFileSync('output.js', output.toString());
When using the flow-remove-types
script, be sure not to direct the output to itself!
Rollup: rollup-plugin-flow
Browserify: unflowify
Webpack: remove-flow-types-loader
Gulp: gulp-flow-remove-types
ESLint: eslint-plugin-flowtype
Mocha: mocha -r flow-remove-types/register
Jest: Add to your config:
transform: {
"^.+\\.js(?:\\.flow)?$": "flow-remove-types/jest"
}
flow-node
Wherever you use node
you can substitute flow-node
and have a super fast
flow-types aware evaluator or REPL.
$ flow-node
> var x: number = 42
undefined
> x
42
Note: This package is also available under the alias
flow-node
since it's often looked for at that location due to the popularity of this script. Both scripts are available no matter which package you install.
Using the require hook allows you to automatically compile files on the fly when requiring in node, useful during development:
require('flow-remove-types/register')
require('./some-module-with-flow-type-syntax')
You can also provide options to the require hook:
// Transforms all files, not just those with a "@flow" comment.
require('flow-remove-types/register')({ all: true })
Use options to define exactly which files to includes
or excludes
with regular
expressions. All files are included by default except those found in the
node_modules
folder, which is excluded by default.
require('flow-remove-types/register')({ includes: /\/custom_path\// })
Don't use the require hook in packages distributed on NPM As always, don't forget to use
flow-remove-types
to compile files before distributing your code on npm, as using the require hook affects the whole runtime and not just your module and may hurt the runtime performance of code that includes it.
When flow-remove-types
removes Flow types, it replaces them with whitespace.
This ensures that the transformed output has exactly the same number of lines
and characters and that all character offsets remain the same. This removes the
need for sourcemaps, maintains legible output, and ensures that it is super easy
to include flow-remove-types
at any point in your existing build tools.
Built atop the official Flow parser,
flow-remove-types
is designed to operate on the same syntax Flow itself understands.
It also passes through other common non-standard syntax such as JSX
and experimental ECMAScript proposals that Flow supports.
Before:
import SomeClass from 'some-module'
import type { SomeInterface } from 'some-module'
export class MyClass<T> extends SomeClass implements SomeInterface {
value: T
constructor(value: T) {
this.value = value
}
get(): T {
return this.value
}
}
After:
import SomeClass from 'some-module'
export class MyClass extends SomeClass {
constructor(value ) {
this.value = value
}
get() {
return this.value
}
}
Rather not have the whitespace? Pass the --pretty
flag to remove the whitespace.
flow-remove-types --pretty --sourcemaps source.js
Or using the JS API:
var flowRemoveTypes = require('flow-remove-types');
var fs = require('fs');
var input = fs.readFileSync('input.js', 'utf8');
var output = flowRemoveTypes(input, { pretty: true });
fs.writeFileSync('output.js', output.toString());
var sourceMap = output.generateMap();
fs.writeFileSync('output.js.map', JSON.stringify(sourceMap));
NOTE: These timings are for
flow-remove-types
v1.
Installing via npm
from an empty project:
flow-remove-types:
time npm install flow-remove-types
real 0m3.193s
user 0m1.643s
sys 0m0.775s
Babel:
time npm install babel-cli babel-plugin-transform-flow-strip-types
real 0m23.200s
user 0m10.395s
sys 0m4.238s
Transforming a directory of 20 files of 100 lines each:
flow-remove-types:
time flow-remove-types src/ --out-dir dest/
real 0m0.431s
user 0m0.436s
sys 0m0.068s
Babel:
time babel src/ --out-dir dest/
real 0m1.074s
user 0m1.092s
sys 0m0.149s
FAQs
Removes Flow type annotations from JavaScript files with speed and simplicity.
The npm package flow-remove-types receives a total of 132,149 weekly downloads. As such, flow-remove-types popularity was classified as popular.
We found that flow-remove-types demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.