
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Inspired on json-schema-validator for JAVA, the --fakeroot option, actually.
If you're validating some RAML (like me) then you should validate your JSON-schemas and examples also.
For this purpose I'm using ramlev which is using tv4, but you're encouraged to download any $ref manually before validating.
var tv4 = require('tv4'),
refaker = require('refaker');
var data = { /* ... */ },
schema = { /* ... */ };
refaker({
schema: schema,
fakeroot: 'http://example.com',
directory: '/path/to/schemas'
}, function(err, refs, schemas) {
if (err) {
console.log(err);
} else {
for (var id in refs) {
// register resolved refs
tv4.addSchema(id, refs[id]);
}
// validates the first passed schema
console.log(tv4.validateResult(data, schemas[0]));
}
});
That's it.
schema (object|aray)
The JSON-schema to validate.
schemas (object|array)
Multiple JSON-schemas to validate at once.
This is an alias for the schema option.
fakeroot (string)
If provided, any matching $ref will be resolved under the specified directory.
directory (string)
A local path containing the JSON-schemas.
If missing, will use process.cwd() instead.
timeout (number)
Timeout when resolving remote schemas, default to 200ms.
Any $ref found will be downloaded or faked locally.
The given callback will receive three arguments:
err (mixed)
Empty means success.
refs (object)
Hash of resolved $refs.
schemas (array)
Normalized schemas if success (same order as input).
FAQs
Download or fake JSON schemas from $ref values
We found that refaker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.