Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The hm-def
package allows you to enforce runtime type checking for JavaScript
functions using Haskell-alike Hindley
Milner type signatures.
The hm-def
is build on top of
sanctuary-def
and basically just a syntax sugar for it.
$ yarn add hm-def
# or
$ npm install hm-def
First, you need to create a function definition function.
import $ from 'sanctuary-def';
import HMD from 'hm-def';
const def = HMD.create({
checkTypes: true,
env: $.env,
});
Then instead of this:
function sum(a, b) {
return a + b;
}
you can write:
const sum = def(
'sum :: Number -> Number -> Number',
(a, b) => a + b
);
And the calls to sum
will be type checked:
sum(42, 13);
// 55
sum('42', 13);
// TypeError: Invalid value
//
// foo :: Number -> Number -> Number
// ^^^^^^
// 1
//
// 1) "42" :: String
//
// The value at position 1 is not a member of ‘Number’.
You pass type definitions with env
option of HMD.create
. $.env
from
sanctuary-def
provides type info for all built-in types:
You would likely to add your own application domain types. See documentation of type constructors to learn how.
For most generic functions you’d like to add type constraints. Consider the function:
const concat = def(
'concat :: a -> a -> a',
(y, x) => x.concat(y)
);
concat([3, 4], [1, 2]);
// [1, 2, 3, 4]
concat(' world', 'Hello')
// 'Hello world'
concat(42, 13)
// TypeError: x.concat is not a function
The call to the function crashed on invalid argument types post factum. We can
place a type constraint on a
to fail in advance with a more clear message.
Type constraints are done with type classes. There are many type classes provided by sanctuary-type-classes and you can create your own.
To use HM definitions with type class constaints you should provide typeClasses
option with classes you’d like to use later:
import $ from 'sanctuary-def';
import Z from 'sanctuary-type-classes';
import HMD from 'hm-def';
const def = HMD.create({
checkTypes: true,
env: $.env,
typeClasses: [
// ...
Z.Functor,
Z.Semigroup,
// ...
],
});
Then:
const concat = def(
'concat :: Semigroup a => a -> a -> a',
(y, x) => x.concat(y)
);
concat([3, 4], [1, 2]);
// [1, 2, 3, 4]
concat(' world', 'Hello')
// 'Hello world'
concat(42, 13)
// TypeError: Type-class constraint violation
//
// foo :: Semigroup a => a -> a -> a
// ^^^^^^^^^^^ ^
// 1
//
// 1) 42 :: Number
//
// ‘foo’ requires ‘a’ to satisfy the Semigroup type-class constraint; the value
// at position 1 does not.
Thanks to sanctuary-def
functions defined with def
are automatically
curried. You haven’t to use R.curry
everywhere.
const sum = def(
'sum :: Number -> Number -> Number',
(a, b) => a + b
);
const add42 = sum(42);
// add42 is a partially applied function
add42(13);
// 55
MIT
FAQs
Runtime type checking with Hindley Milner signatures
The npm package hm-def receives a total of 6 weekly downloads. As such, hm-def popularity was classified as not popular.
We found that hm-def demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.