
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
narrow-types
Advanced tools
A collection of branded Typescript types, using [zod](https://github.com/colinhacks/zod/) as the underlying validation library.
A collection of branded Typescript types, using zod as the underlying validation library.
import { emailString, EmailString } from "narrow-types";
// The address parameter must be a validated email address
function sendEmail(address: EmailString, subject: string) {
// ...
}
// This function accepts any string
function logString(message: string) {
// ...
}
// myEmail is an EmailString
const myEmail = emailString.parse("john@doe.com");
sendEmail(myEmail, "Hello"); // Works
logString(myEmail); // Works as well. EmailStrings are strings as far as JS is concerned.
sendEmail("john@doe", "Hello"); // Error: address is not an EmailString
npm install narrow-types
So you are using Zod to make an air tight boundary between the outside and your type safe core. Say you have an endpoint that looks something like this:
const signupBody = z.object({
email: z.string().email(),
password: z.string().min(8),
});
autoRoutes.post("/signup", async (ctx) => {
const body = signupBody.parse(ctx.req.body);
ctx.state.db.accounts.insert({
site: ctx.state.site,
email: body.email,
password: await hash(body.password),
});
ctx.body = { success: true };
});
Great! You have a nice, clean endpoint. You are certain that the email inserted is a valid email address and that the password is at least 8 characters. But what if you would like to extract a function for signing people up so it could be used elsewhere? You could do something like this:
async function signup(
db: Database,
site: string,
email: string,
password: string
) {
db.accounts.insert({
site,
email,
password: await hash(password),
});
}
and call that. But now you are no longer sure that the provided email is valid. You could move the Zod validation step into the function, but if you want to keep it in the endpoint as well for some reason, you will now be validating twice at runtime which is a performance cost, and not very pretty either.
Instead, you can use the EmailString
type from this library:
import { EmailString } from "narrow-types";
async function signup(
db: Database,
site: string,
email: EmailString,
password: string
) {
db.accounts.insert({
site,
email,
password: await hash(password),
});
}
Now, the type of email
is EmailString
which is a string that has been validated to be a valid email address. To use it, we modify our Zod schema and endpoint to look like this:
import { emailString } from "narrow-types";
const signupBody = z.object({
email: emailString,
password: z.string().min(8),
});
authRoutes.post("/signup", async (ctx) => {
const body = signupBody.parse(ctx.req.body);
signup(ctx.state.db, ctx.state.site, body.email, body.password);
ctx.body = { success: true };
});
The EmailString
type is just a branded string, incurring no runtime cost. It is just a way to tell Typescript that the string is a valid email address. This allows us to use the same type in both the endpoint and the function, and we can be sure that the email address is valid in both places. Any function that expects a plain string will accept an EmailString
as well, but not the other way around.
This library contains a number of types for common use cases, all compatible with Zod.
Integer
Int2
Int4
Int8
PositiveNumber
NegativeNumber
NonPositiveNumber
NonNegativeNumber
FiniteNumber
SafeNumber
NonEmptyString
UUIDString
CUIDString
CUID2String
ULIDString
EmailString
URLString
IPString
IPV4String
IPV6String
MACAddressString
JwtString
HexColorString
HexColorWithAlphaString
EmojiString
DateTimeString
JSONString
FAQs
A collection of branded Typescript types, using [zod](https://github.com/colinhacks/zod/) as the underlying validation library.
The npm package narrow-types receives a total of 4 weekly downloads. As such, narrow-types popularity was classified as not popular.
We found that narrow-types demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.