
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Sometimes you have to work with libraries that don't have typings, or have overly-permissive typings. This minimalist library allows you to request more specific/strict type checking.
E.g.
// Let's say you have a variable that should really be a `number`, but some fool left it as `any`.
let shouldBeANumber: any;
// If you try to assign a non-number to it, TypeScript will allow you to (it doesn't know any better)
shouldBeANumber = "hello"; // Succeeds
// The traditional way to resolve this would be to assign your intended value to another variable, and then assign it to the target variable
const myValue: number = "hello"; // Now it fails
shouldBeANumber = myValue;
// But that's clunky and requires multiple statements, it can't be done inline. (Well, it can be done inline, but that would be even more disgusting)
// Instead, import ts-demand
import {demand} from 'ts-demand';
// And now when you want additional typechecking, you can demand it
shouldBeANumber = demand<number>("hello"); // Hooray, it fails!
No. I gave a very simple example, but in the real world I come across similar issues a lot with complicated objects. In these situations, having typechecking is incredibly valuable for avoiding mistakes.
An example would be when specifying plugin configs in a gatsby-config file.
Because Microsoft/TypeScript#7481 hasn't been implemented yet.
Usually yes, but that would take much more effort than using this helper does.
This dependency has no other dependencies, so hopefully that's acceptable. If you don't want to add even a single extra dependency, feel free to just copy the demand function from src/index.ts. It's a one-liner.
FAQs
Request type checking where it isn't already required.
We found that ts-demand demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.