
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
Funclify is an **opinionated** framework for building APIs on Netlify Functions. It's fast, it's powerful and most importantly focused around a great developer experience.
Funclify is an opinionated framework for building APIs on Netlify Functions. It's fast, it's powerful and most importantly focused around a great developer experience.
Currently, this is a TypeScript-only framework. This reflects the current focus of the project, being a type-safe and DX focused package, and in the future it may be updated to compile to support ESM. It's early days, so please forgive the narrow-focus.
Funclify is very early on in it's development. It may be abandoned, it may be completely up-ended and rewriten in Rust đź‘€, so as much as I'd love to say use this in production, bear those things in mind.
# pnpm
pnpm add funclify
# npm
npm install funclify
Funclify includes an API class which is the entry point for both defining handlers and also processing requests.
// netlify/functions/api.ts
import { Api } from 'funclify';
const api = new Api();
api.get("/", async (_, res) => {
return res.withJSON({ message: "Hello World!" });
});
export const handler = api.baseHandler;
Funclify is focused on being a strongly-typed framework. This extends to route parameters. Making heavy use of infer, we can create a strongly-typed params property that lives on the req argument passed to your route handler.
api.get("/users/:user_id/orders/:order_id", async({ params }, res) => {
// params: { user_id: string, order_id: string }
const { user_id, order_id } = params;
const order = await fetchOrder(user_id, order_id);
return res.withJSON(order);
})
Funclify comes bundled with a test harness to make it simple to run integration tests against your API.
Although you could adopt a more "unit" approach, the framework is built to encourage testing to the boundary of your application for each and every API route.
An example below utilising Vitest
import { describe, it, beforeEach, expect } from "vitest";
import { ApiTestHarness } from "funclify";
import { api } from "../functions/api";
describe("API", () => {
let test: ApiTestHarness<typeof api>;
beforeEach(() => {
// This could be set once rather than in before-each, as
// in theory an API should be idempotent. However, for flexibility
// atomicity can be guaranteed by initialising in the beforeEach
test = new ApiTestHarness(api);
});
it("should return a user object", async () => {
// Perform the request. Under the hood, this
// emulates the `event` and `context` fed in
// from a Netlify Function
const response = await test.get("/user/123");
expect(response.statusCode).toBe(200);
// Regardless of your application output, the response
// from a Netlify Function will be a string, so we need
// to parse into JSON to assert on the returned objects
expect(response.body).toBeTypeOf("string");
const body = JSON.parse(response.body!);
expect(body).toContain({
id: "123",
name: "Ed",
});
});
});
FAQs
Funclify is an **opinionated** framework for building APIs on Netlify Functions. It's fast, it's powerful and most importantly focused around a great developer experience.
The npm package funclify receives a total of 0 weekly downloads. As such, funclify popularity was classified as not popular.
We found that funclify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.