
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
ts-semver-analyzer
Advanced tools
A TypeScript library for detecting breaking changes and semantic versioning updates between TypeScript definitions
A TypeScript library for detecting breaking changes and semantic versioning updates between TypeScript definitions. This tool helps maintain API compatibility by analyzing TypeScript interfaces, types, and functions.
This package is currently in active development. While all current tests are passing, we welcome contributions to enhance the test coverage and robustness in the following areas:
If you'd like to contribute, check out the Contributing section below!
major, minor, or patch version recommendationsyarn add ts-semver-analyzer
./types/v1.d.ts:
export interface User {
name: string;
age?: number; // Optional age in v1
}
./types/v2.d.ts:
export interface User {
name: string;
age: number; // Required age in v2 (breaking change)
}
import {
SemverChangeDetector,
type DetectorOptions,
type ChangeReport
} from 'ts-semver-analyzer';
import * as fs from 'fs';
// Configure the detector
const options: DetectorOptions = {
previous: {
name: 'v1.d.ts',
content: await fs.promises.readFile('./types/v1.d.ts', 'utf-8')
},
current: {
name: 'v2.d.ts',
content: await fs.promises.readFile('./types/v2.d.ts', 'utf-8')
}
};
// Initialize and use the detector
async function analyzeChanges(): Promise<void> {
const detector = new SemverChangeDetector(options);
// Initialize the detector (optional, will be called automatically by detectChanges)
await detector.initialize();
// Detect changes between versions
const report: ChangeReport = await detector.detectChanges();
console.log(report);
}
/*
Output:
{
changeType: "major",
changes: [
"BREAKING: Changed member age in interface User from optional to required",
],
}
*/
We welcome contributions to improve the library! Here are some key areas where help is needed:
Clone the repository:
git clone https://github.com/Bryan-Cee/ts-semver-analyzer.git
cd ts-semver-analyzer
Install dependencies:
npm install
Run tests:
npm test
Run a specific test file:
npm test -- src/**test**/SemverChangeDetector.test.ts
Build the project:
npm run build
TODO: This is yet to be added
If you encounter any issues or have suggestions for improvements, please open an issue on the GitHub repository. Include the following details:
FAQs
A TypeScript library for detecting breaking changes and semantic versioning updates between TypeScript definitions
We found that ts-semver-analyzer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.