
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
openpkg-sdk
Advanced tools
TypeScript SDK for generating and post-processing OpenPkg specs directly from your tooling.
# npm
npm install openpkg-sdk
# bun
bun add openpkg-sdk
# yarn
yarn add openpkg-sdk
# pnpm
pnpm add openpkg-sdk
import { OpenPkg } from 'openpkg-sdk';
const openpkg = new OpenPkg({
resolveExternalTypes: true,
});
const spec = await openpkg.analyzeFile('./src/index.ts', {
filters: {
include: ['createUser', 'deleteUser'],
},
});
console.log(`exports: ${spec.exports.length}`);
console.log(`types: ${spec.types?.length ?? 0}`);
OpenPkg automatically resolves local sources, merges in declaration files, and keeps type references intact. Use filters.include / filters.exclude to narrow the surface area that lands in the final spec.
import { analyzeFile } from 'openpkg-sdk';
const spec = await analyzeFile('./src/index.ts', {
filters: {
include: ['publicFunction'],
exclude: ['internalHelper'],
},
});
Filtering trims both the exports array and orphaned items under types. The SDK will surface informational diagnostics whenever an identifier cannot be located or when filtering drops transitive types you may still need.
Use the analyzeFileWithDiagnostics or analyzeWithDiagnostics helpers when you need visibility into parsing or filtering issues.
import { OpenPkg } from 'openpkg-sdk';
const openpkg = new OpenPkg();
const { spec, diagnostics } = await openpkg.analyzeFileWithDiagnostics('./src/index.ts');
diagnostics.forEach((diagnostic) => {
const location = diagnostic.location?.file
? `${diagnostic.location.file}:${diagnostic.location.line ?? '?'}:${diagnostic.location.column ?? '?'}`
: '(unknown)';
console.log(`[${diagnostic.severity}] ${location} ${diagnostic.message}`);
});
Diagnostics normalize TypeScript compiler messages into error, warning, and info severity levels so you can decide how to surface them in your own tools.
import { analyze } from 'openpkg-sdk';
const spec = await analyze(
`export const sum = (a: number, b: number) => a + b;`,
{ filters: { include: ['sum'] } },
);
import { OpenPkg } from 'openpkg-sdk';
import { glob } from 'glob';
const openpkg = new OpenPkg();
const files = await glob('packages/**/src/index.ts');
const specs = await Promise.all(files.map((file) => openpkg.analyzeFile(file)));
new OpenPkg(options?)
analyze(code, fileName?, options?)analyzeFile(filePath, options?)analyzeWithDiagnostics(code, fileName?, options?)analyzeFileWithDiagnostics(filePath, options?)analyze(code, options?) – convenience wrapperanalyzeFile(filePath, options?) – convenience wrapperextractPackageSpec(entry, packageDir, source, options) – lower-level extractorOpenPkgSpec, FilterOptions, AnalyzeOptions, AnalysisResult, Diagnosticgit clone https://github.com/ryanwaits/openpkg.git
cd openpkg
bun install
bun run build:sdk
bun test
MIT
FAQs
TypeScript package specification SDK
We found that openpkg-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.