Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Expensive plain object type validator leverages TypeScript language service.
⏱️ EXPENSIVE plain object type validator leverages TypeScript language service.
Category | Complex Type | Extended Validation | Zero Build Setups | Performance |
---|---|---|---|---|
Tiva | Yes | Yes | Yes | In many case not tolerable |
ajv alike | Yes | Yes* | No | Much much better than Tiva |
io-ts alike | Limited** | Yes | Yes | Much much better than Tiva |
* Extra efforts might be needed for extended validation to work with TypeScript declarations.
** We have many types that are evaluated from pure type declarations, and those type declarations are used in other part of our project for type checking and intellisense purpose. And aside from that, writing complex type with those tools will not be as pleasant as natural type declarations.
yarn add tiva
import {Tiva} from 'tiva';
let tiva = new Tiva();
tiva.validate('string[]', ['foo', 'bar']).then(console.info, console.error);
tiva
.validate(
{module: 'module-specifier', type: 'AwesomeType'},
{foo: 'abc', bar: 123},
)
.then(console.info, console.error);
Tiva can validate with extended validator functions that matches by @tag
in JSDoc comments (one tag per line):
interface Foo {
/** @uuid */
id: string;
}
There are a few built-in extensions:
@pattern <pattern>
Validate by regular expression pattern.@uuid [version]
UUID.@unique [group]
Validate that there's no more than one occurrence.Checkout @built-in-extensions.ts for implementation details.
Writing custom extensions is easy:
let tiva = new Tiva({
extensions: {
custom(value) {
if (value === 'custom') {
return undefined;
}
return `Value "${value}" must be "custom"`;
},
},
});
Tiva provides a Validator
class that synchronously manipulates TypeScript language service to do the heavy lifting; and a Tiva
class that creates a worker to run Validator
in another thread.
The type check part is simple: it just gets the diagnostic messages from TypeScript by fabricating a variable statement. The tricky part is the extended validation.
Here's how Tiva does it:
Again the heavy lifting is done by the TypeScript language service. And doing this way also makes it possible to have Tiva work with complex types including condition types, mapping types etc.
MIT License.
FAQs
Expensive plain object type validator leverages TypeScript language service.
The npm package tiva receives a total of 1,965 weekly downloads. As such, tiva popularity was classified as popular.
We found that tiva demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.