
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
This is an early work in progress, consider this an unsupported speculative draft
A small finite-state automata framework for JS, built with first-class TypeScript support.
For example, let's say we want to represent a login flow for a user in a web
application. Our application state has a User object:
interface User {
admin: boolean
authed: boolean
}
let user: User = {
admin: false,
authed: false,
};
We can define a state machine for our User type which will represent the
navigation flow for logging in.
const fsm = new mata.Machine<User>({
The Machine constructor takes a single Initializer object which has two
required keys machine and config. The machine key is the definition
of the state machine. It is of the form: { from: { to: condition } }:
machine: {
signIn: {
adminView: (u) => u.admin,
userView: (u) => u.authed && !u.admin
},
adminView: {
signOut: (u) => !u.authed
},
userView: {
signOut: (u) => !u.authed
},
signOut: {
signIn: mata.Continue
}
},
So if the machine is in the state adminView, it will transition to the state
signOut if the user.authed property is false.
The other part of the Initialization argument is config. It requires an
init argument of the form (states: ValidStates) => State. The states
argument is a lookup table of every known state.
config: {
init: (states) => states.signIn
}
});
At runtime, the state property represents the current state. The states
property is a lookup table for all valid states.
fsm.state === fsm.states.signIn; // initial state
The next(input) method causes the state machine to transition to the next
valid state with a condition that returns true for input.
user.authed = true;
fsm.next(user);
fsm.state === fsm.states.userView;
next doesn't always cause a state change â if no condition is satisfied then
the state remains the same.
fsm.next(user);
fsm.state === fsm.states.userView;
The subscribe method registers a listener function that is executed every
time the state transitions. The Listener is of the type
(e: TransitionEvent) => void. The TransitionEvent includes from, to and
input keys. NOTE: The input will be null if transition is invoked manually.
fsm.subscribe(({ from, to, input }) => {
console.log(`Transition: ${from} --> ${to} for ${input}`);
});
user.authed = false;
fsm.next(user);
// Transition: userView --> signOut for { authed: false, admin: false }
If you wish to detach your Listener, store the return value of
subscribe, it is a function which will unsubscribe your new listener when
executed:
const unsubscribe = fsm.subscribe(({ from, to, input }) => { });
// ... later
unsubscribe(); // listener will no longer execute
mata/visualizers provides some functions for turning a state machine into
a graph description. Currently Mermaid and
Dot are supported. The example
state machine from this readme looks like:
toMermaid:
toDot:
FAQs
Input-driven finite state automata
The npm package mata receives a total of 2 weekly downloads. As such, mata popularity was classified as not popular.
We found that mata demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.