
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
ts-node-dev
Advanced tools
Tweaked version of node-dev that uses ts-node under the hood.
It restarts target node process when any of required files changes (as standard node-dev) but shares Typescript compilation process between restarts. This significantly increases speed of restarting comparing to node-dev -r ts-node/register ..., nodemon -x ts-node ... variations because there is no need to instantiate ts-node compilation each time.
yarn add ts-node-dev
npm i ts-node-dev
ts-node dependency version is not fixed, so it will install the latest version by default.
ts-node-dev [node-dev|ts-node flags] [ts-node-dev flags] [script] [script arguments]
So you just combine node-dev and ts-node options (see docs of those packages):
ts-node-dev --respawn --transpileOnly server.ts
Also there are additional options specific to ts-node-dev:
--prefer-ts (default: false) - for each .js file (that is not in node_modules) will try to check if corresponding .ts version exists and require it.--ignore-watch (default: []) - files/folders to be ignored by node-dev. But also this behaviour enhanced: it will also make up new RegExp of passed ignore string and check absolute paths of required files for match.
So, to ignore everthing in node_modules, just pass --ignore-watch node_modulesNB! --ignore-watch will NOT affect files ignored by TS compilation. Use --ignore option (or TS_NODE_IGNORE env variable) to pass RegExp strings for filtering files that should not be compiled, by default /node_modules/ are ignored.
The good thing is that ts-node-dev watches used tsconfig.json file, and will reinitialize compilation on its change, but you have to restart the process manually when you update used version of typescript or make any other changes that may effect compilation results.
WTF.
Nodemon is a utility that monitors for any changes in your source and automatically restarts your server. It is language-agnostic and can be used with JavaScript, TypeScript, and other languages. Unlike ts-node-dev, nodemon does not provide TypeScript compilation out of the box and requires additional setup to work with TypeScript.
ts-node is a TypeScript execution environment and REPL for Node.js. It allows you to run TypeScript code directly without precompiling. However, it does not provide automatic restarts on file changes, which is a feature provided by ts-node-dev.
Webpack is a module bundler that can be used to compile TypeScript code and watch for changes. It is highly configurable and can be used with various plugins and loaders to achieve similar functionality to ts-node-dev. However, it is more complex to set up and configure compared to ts-node-dev.
FAQs
Compiles your TS app and restarts when files are modified.
The npm package ts-node-dev receives a total of 1,715,929 weekly downloads. As such, ts-node-dev popularity was classified as popular.
We found that ts-node-dev demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.