
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
refactor-check
Advanced tools
A tool to validate that PR changes conform to specified refactoring patterns, enabling safer automated code transformations.
When performing automated refactorings (like adding type annotations across many files), you want to ensure that ONLY the intended changes were made. This tool:
npm install -g refactor-check
Or run directly with npx:
npx refactor-check <pr-number> [pattern-file]
refactor-check <pr-number> [pattern-file]
Examples:
# Use pattern from PR description (```refactor-check block)
refactor-check 1821
# Use local pattern file
refactor-check 1821 example-patterns/add-props-types.yaml
If you don't specify a pattern file, the tool will fetch the pattern from the PR description. Add a refactor-check code block to your PR description:
## Refactor Pattern
```refactor-check
allowed_patterns:
- change: "Add type annotation"
before: "function ${Name}({ ${Params} })"
after: "function ${Name}({ ${Params} }: ${Type})"
excluded_files:
- path/to/file.tsx
```
Pattern files are written in YAML and specify exactly what code transformations are allowed.
name: "Refactoring Name"
allowed_patterns:
- change: "Description of what this pattern does"
before: "code pattern before"
after: "code pattern after"
excluded_files:
path/to/file.tsx: "Reason this file has other changes"
Patterns use holes to match code transformations:
${Name} - Matches any text that doesn't contain unbalanced delimiters ()[]{}'${Path}/firebaseutil.js' matches '../util/firebaseutil.js'The tool automatically combines "add" and "remove" patterns:
This means you don't need explicit "change" patterns - just define what can be added and removed.
Use ${Path} to match any path prefix, making patterns work regardless of import style:
- change: "Remove import from firebaseutil (any path)"
before: "import { ${Items} } from '${Path}/firebaseutil.js';"
after: ""
This matches:
import { foo } from 'util/firebaseutil.js';import { foo } from '../util/firebaseutil.js';import { foo } from '../../util/firebaseutil.js';- change: "Change import from one path to another"
before: "import { ${Items} } from '${FromPath}';"
after: "import { ${Items} } from '${ToPath}';"
This matches:
// Before
import { foo, bar } from '../util/firebaseutil.js';
// After
import { foo, bar } from '../util/keyutil.js';
The ${Items} must match exactly in before/after (same items imported).
- change: "Add generic type to hook"
before: "${Hook}(${Args})"
after: "${Hook}<${Type}>(${Args})"
This matches:
// Before
const [items, setItems] = useState([])
// After
const [items, setItems] = useState<string[]>([])
- change: "Add import statement"
before: ""
after: "import { ${Items} } from '${Path}';"
This matches any new import being added.
The tool will:
✅ Pass - If all changes match the allowed patterns
✅ All changes conform to the allowed patterns!
✅ PR #1821 is ready for review.
❌ Fail - If some files have non-conforming changes
❌ Found 3 file(s) with non-conforming changes:
client/feature/topic/reading-list.tsx
Contains changes not matching allowed patterns
(2 hunk(s) don't match any pattern)
📝 Suggested additions to excluded_files:
client/feature/topic/reading-list.tsx: "Contains changes not matching allowed patterns"
Files listed in excluded_files are skipped during pattern checking. Use this for files that legitimately need other changes beyond the refactoring.
excluded_files:
# Exclude specific file
client/some/file.tsx: "Also fixes a bug in validation logic"
# Exclude entire folder (note trailing /)
server/adapter/: "New adapter implementation files"
# Exclude pattern with wildcards
**/*.test.ts: "Test files have additional changes"
server/modules/*.ts: "All module files need review"
Supported patterns:
path/to/file.ts - Matches only that specific filepath/to/folder/ - Matches all files in that folder (note trailing /)* matches any characters except / (single folder level)** matches any characters including / (multiple folder levels)? matches any single characterExamples:
server/adapter/ - Excludes server/adapter/auth/types.ts, server/adapter/database/firebase.ts, etc.**/*.test.ts - Excludes all test files in any folderserver/modules/*.ts - Excludes all .ts files directly in server/modules/gh pr diffPR #1821 adds TypeScript prop types to React components. The pattern file specifies:
Result: 34/37 files matched the patterns perfectly. 3 files were flagged because they had additional changes (modifying existing type definitions), which correctly required manual review.
index.js - Main tool implementationhole-matcher.js - Hole-based pattern matching engineexample-patterns/add-props-types.yaml - Example pattern file for adding React prop typesexample-patterns/auth-adapter-refactor.yaml - Example pattern file for auth adapter refactoringREADME.md - This filegh CLI (GitHub CLI) installed and authenticatedApache-2.0
FAQs
Tool to validate PR changes conform to refactoring patterns
The npm package refactor-check receives a total of 0 weekly downloads. As such, refactor-check popularity was classified as not popular.
We found that refactor-check demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.