
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
neverthrow
Advanced tools
Encode failure into your program.
This program contains a Result type that represents either success (Ok) or failure (Err).
This package works for both JS and TypeScript. However, the types that this package provides will allow you to get compile-time guarantees around error handling if you are using TypeScript.
Although the package is called neverthrow, please don't take this literally. I am simply encouraging the developer to think a bit more about the ergonomics and usage of whatever software they are writing. Throwing and catching is syntactic sugar for goto statements - in other words; it makes reasoning about your programs harder.
With all that said, there are definitely good use cases for throwing in your program. But much less than you might think.
Folktale is a standard library for functional programming in JavaScript. It provides similar functionality to neverthrow with its Result and Maybe types, but also includes a broader range of functional programming utilities.
fp-ts is a library for functional programming in TypeScript. It offers a comprehensive set of tools for functional programming, including Result and Option types, similar to neverthrow, but with a more extensive ecosystem and integration with other functional programming concepts.
Purify is a functional programming library for TypeScript that provides Maybe and Either types, which are analogous to neverthrow's Option and Result types. It focuses on immutability and functional programming patterns.
FAQs
Stop throwing errors, and instead return Results!
The npm package neverthrow receives a total of 1,509,574 weekly downloads. As such, neverthrow popularity was classified as popular.
We found that neverthrow demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.