
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
Stop writing TypeScript types by hand.
snaptype is a CLI that turns your JSON files, CSV exports, REST APIs, and OpenAPI/GraphQL schemas into TypeScript interfaces and Zod schemas — in one command.
→ snaptype.dev — docs, Pro licence, live demo
Every time you hit an API or open a data file, you end up writing types by hand. You copy-paste a JSON response, squint at the shape, type out an interface. The API changes — you do it again.
snaptype automates that step entirely.
npx snaptype from-json ./user.json -o types.ts
Input — user.json:
{
"id": 1,
"name": "Alice",
"email": "alice@example.com",
"role": "admin",
"createdAt": "2024-01-15T10:30:00Z",
"address": { "city": "Paris", "zip": "75001" }
}
Output — types.ts:
// Generated by snaptype — do not edit manually
export interface Address {
city: string;
zip: string;
}
export interface User {
id: number;
name: string;
email: string; // email
role: string;
createdAt: string; // ISO 8601
address: Address;
}
Add --zod to also get a ready-to-use Zod schema:
npx snaptype from-json ./user.json -o types.ts --zod
// types.zod.ts — Generated by snaptype
import { z } from 'zod';
export const AddressSchema = z.object({
city: z.string(),
zip: z.string(),
});
export const UserSchema = z.object({
id: z.number(),
name: z.string(),
email: z.string().email(),
role: z.string(),
createdAt: z.string().datetime(),
address: AddressSchema,
});
export type User = z.infer<typeof UserSchema>;
npm install -D snaptype
# peer dep if you use --zod
npm install zod
Requires Node.js 20+.
| Source | Command |
|---|---|
| Local JSON file | snaptype from-json ./data.json -o types.ts |
| Live API / URL | snaptype from-url https://api.example.com/users -o types.ts |
| CSV file | snaptype from-csv ./export.csv -o types.ts |
| stdin (pipe) | curl https://… | snaptype from-stdin --name User -o types.ts |
| OpenAPI 3.x spec | snaptype from-openapi ./openapi.yaml -o types.ts |
| GraphQL endpoint | snaptype from-graphql https://…/graphql -o types.ts (Pro) |
string, number, boolean, nullemail, url, ISO 8601 dates → .email(), .url(), .datetime() in Zod$ref, oneOf, allOf, anyOf from OpenAPI specs# Detect breaking changes between two type files (Pro)
snaptype diff old.ts new.ts
# Generate realistic mock data from a schema (Pro)
snaptype mock ./types.ts -o mocks.ts
# Convert existing TypeScript interfaces to Zod schemas (Pro)
snaptype to-zod ./src/types/user.ts
# Re-export all generated files in one barrel file
snaptype barrel ./src/types
# Watch a source file and regenerate on change (Pro)
snaptype from-json ./api.json -o types.ts --watch
Drop a .snaptyperc at the root of your project to stop repeating flags:
{
"naming": "camel",
"emit": "interface",
"zod": true,
"outDir": "src/types"
}
CLI flags always take priority. See the configuration docs for all keys.
Pro is a one-time purchase — no subscription, works across machines.
| Feature | Free | Pro |
|---|---|---|
from-json (single file) | ✓ | ✓ |
from-url, from-csv, from-stdin | ✓ | ✓ |
from-openapi (single file) | ✓ | ✓ |
| TypeScript + Zod generation | ✓ | ✓ |
| Semantic inference (email, date, url) | ✓ | ✓ |
| Enum / union literal detection | ✓ | ✓ |
--readonly, .snaptyperc, barrel | ✓ | ✓ |
from-json / from-url (multiple files) | — | ✓ |
from-graphql | — | ✓ |
snaptype diff + --ci | — | ✓ |
snaptype mock | — | ✓ |
snaptype to-zod | — | ✓ |
--watch | — | ✓ |
MIT — free tier is free forever. Pro features require a licence key.
FAQs
Generate TypeScript types and Zod schemas from JSON, CSV, or live API responses
The npm package snaptype receives a total of 10 weekly downloads. As such, snaptype popularity was classified as not popular.
We found that snaptype demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.