
Security News
New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.
Errors and warnings your users (and their agents) can actually act on.
Every diagnostic is a typed, structured object with a stable code, a clear explanation, a suggested fix, and a docs link. No more grepping log output or guessing what an error means.
[NUXT_B2011] Invalid plugin `/plugins/bad.ts`. src option is required.
├▶ fix: Pass a string path or an object with a `src` property to `addPlugin()`.
├▶ sources: /Users/me/projects/my-nuxt-app/nuxt.config.ts:14:3
╰▶ see: https://nuxt.com/e/b2011
Library errors today are strings. Users scan them, agents pattern-match them, and everyone loses context. nostics turns each diagnostic into a Diagnostic instance: stable code, human why, actionable fix, structured sources, and a per-code docs URL. Humans get a searchable code and a fix in the same glance. Agents get machine-readable fields to dispatch on, instead of regexing message text.
import { defineDiagnostics, reporterLog } from 'nostics'
const diagnostics = defineDiagnostics({
docsBase: 'https://nuxt.com/e',
reporters: [reporterLog],
codes: {
NUXT_B2011: {
why: (p: { src: string }) => `Invalid plugin \`${p.src}\`. src option is required.`,
fix: 'Pass a string path or an object with a `src` property to `addPlugin()`.',
},
},
})
// Report (continues execution) or throw — both are fully typed.
diagnostics.NUXT_B2011({ src: pluginPath })
throw diagnostics.NUXT_B2011({ src: pluginPath })
That's it. diagnostics.NUXT_B2011 is cmd+clickable, TypeScript checks params at the call site, and the result extends Error, so it works anywhere an Error does.
Browser diagnostics are invisible to terminal-bound agents. The dev reporter fixes that: it forwards each diagnostic over Vite's HMR channel to a server-side plugin, which appends them to a log file your agent can tail. The Claude Code plugin sets this up automatically.
// src/diagnostics.ts
import { defineDiagnostics, reporterLog } from 'nostics'
import { devReporter } from 'nostics/reporters/dev'
export const diagnostics = defineDiagnostics({
reporters: [reporterLog, devReporter],
codes: {
/* ... */
},
})
import { nosticsCollector } from 'nostics/unplugin/dev-server-collector'
// vite.config.ts
import { defineConfig } from 'vite'
export default defineConfig({
plugins: [
nosticsCollector.vite({
logFile: '.nostics.log', // default: .nostics.log
}),
],
})
[!WARNING]
nosticsCollectoris Vite only. It relies onconfigureServer+server.ws, which have no equivalent in other bundlers, so the.rolldown(),.rollup(),.webpack(),.rspack(),.esbuild(), and.farm()adapters are exposed by unplugin but are no-ops here.
Now every diagnostic call in the browser is appended to .nostics.log as it happens. reporterLog still prints to the browser console. devReporter runs alongside it, not as a replacement.
Diagnostic instances. Extend Error, serialize via toJSON(), survive process boundariesIncludes a Claude Code plugin so agents learn the API automatically: an auto-loaded reference skill and a /add-diagnostic command for scaffolding new codes.
gh api repos/vercel-labs/nostics/contents/install.sh --jq '.content' | base64 -d | bash
FAQs
Structured diagnostic code library
The npm package nostics receives a total of 1,033,727 weekly downloads. As such, nostics popularity was classified as popular.
We found that nostics demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.

Security News
The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.

Security News
A Shai-Hulud infection exposed Suno's source code, which shows the AI music startup stream-ripped tracks to train its models.