
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
node-red-ts
Advanced tools
This project was born because I hate the overly complex and nested structure of the Node-RED API. I wanted something easy and clean and typescript-based.
This is how a simply node looks like:
import { AbstractNode } from "@redts/api/AbstractNode";
import { NodeAPI, NodeMessage } from "node-red";
class DummyNode extends AbstractNode<NodeMessage> {
public constructor(RED: NodeAPI) {
super(RED);
}
public override async onInput(msg?: NodeMessage): Promise<NodeMessage[]> {
console.debug("input");
this.status = "";
return [{ payload: "dummy test" }];
}
public override async onClose(removed: boolean): Promise<void> {
console.debug('input');
this.status = '';
}
}
module.exports = (RED: NodeAPI) => AbstractNode.createNode(RED, DummyNode);
The corresponding HTML file looks a little bit more complex though:
<!-- definition -->
<script type="text/javascript">
RED.nodes.registerType("DummyNode", {
category: "HHLA",
color: "#1eb3fd",
icon: "font-awesome/fa-cogs",
defaults: {
name: { value: "" },
},
inputs: 1,
outputs: 1,
outputLabels: [
"summary",
],
label: function () {
return this.name || "Dummy"
},
paletteLabel: "Dummy",
oneditprepare: () => {
}
});
</script>
<!-- edit dialog -->
<script type="text/html" data-template-name="DummyNode">
<!-- name -->
<div class="form-row">
<label for="node-input-name"><i class="fa fa-tag"></i> Name</label>
<input type="text" id="node-input-name" placeholder="Name" />
</div>
</script>
<!-- help text -->
<script type="text/html" data-help-name="DummyNode">
<p>
</p>
</script>
The HTML structure is based on the Node-RED API. Ideally this would be generated from a type-safe representation, maybe a TS class or another well defined structural language.
The node files are in the "src/nodes" folder of this project.
The project itself is runnable in node-red and fully debuggable in vscode (launch config and all is included).
It looks like this:

A quick-starter template can be found here: https://github.com/mojo2012/node-red-ts-template. Just check it out and run it.
The AbstractNode has a bunch of methods that can be used or overriden in your node, for example:
onInputonClosesetProperty/getPropertysetStatuscontextflowContextglobalContextThe onInput method is triggered when a message arrives. It returns an array of messages (in the most cases just one). Each message in the array is passed to one output. The number of outputs has to be configured in the HTML file though.
Create new nodes using this command node node_modules/node-red-ts/tools/create-node.js. This command will create a new node (html and ts file) in the src/nodes folder and also register the node in the package.json.
You can then build and launch node-red and start coding on your new node.
AbstractNodeFAQs
This is a typescript API for developing node-red packages
We found that node-red-ts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.