
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
A CLI tool that analyses your code based on function length and indentation depth, checking for basic impediments to readability.
A CLI tool that analyses your TypeScript of JavaScript code, checking for basic impediments to readability. The tool can be configured via a YAML config that sets limits on the length, in lines, of certain code block types, like functions, loops and classes. You can also set limits on the total number of occurences of these types in a given file. This is useful for reducing the number of conditionals in your code or reducing the number of functions in a class. Files that may have different structure to the rest of your project can be ignored. The data is then displayed in table form in the terminal, using Taybl.
To install TidyScript run
npm i tidyscript
To analyze your code using TidyScript, add it as a script to your package.json as
"tidyscript": tidyscript
and then run the command
npm run tidyscript <path>
where <path> is the directory or file that you want to analyze. Glob patterns can also be used.
This will run TidyScript using some default values.
Installing TidyScript globally means you can just run
tidyscript <path>
from the root of any project.
To customise the limits you want to impose, and ignore any extraneous files, you'll need a .tidyscript.yml config file. A config file can be generated by running
tidyscript init
at the root of your project. Then values can be added for specific block types based on number of lines or number of occurences in any given file.
All blocks that violate these rules are then tabulated and displayed in the terminal.
Line limits are limits on the number of lines in a given block type. That is, if a limit of 6 is specified for the 'function' type, then all functions with more than 6 lines in their body will be reported on. This is useful because functions, loops, if-statements and pretty much any block type becomes increasingly difficult to understand as the number of lines increases.
Type limits are limits on the number of occurences of a certain block type in a given file. That is, if a limit of 1 is specified for the 'class' type, then all files containing more than 1 class will be reported on. This is useful because code can often become worse with high concentrations of if-statements or loops. Also, for example, declaring multiple classes in the same file can sometimes be useful, but, more often than not, confuses the intention of the code.
Some files have a purpose entirely different to the rest of the code, and thus don't abide by traditional ideas of cleanliness. It therefore makes more sense to ignore these files, rather than analyze them. To ignore a file or directory, add it to the list of files to ignore in the tidyscript config. Remember to seperate these paths into a list by using hyphens. Glob patterns are allowed in the ignore list, however, depending on the number of files matching the glob, this could impact performance. It is best to just ignore individual files and directories where possible.
All contributions to TidyScript are welcome! Bug reports and feature requests are also encouraged. New functionality should be tested, and all existing tests should pass too. No one will be mad at you if you get it wrong so feel free to get involved!
FAQs
A CLI tool that analyses your code based on function length and indentation depth, checking for basic impediments to readability.
We found that tidyscript demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.