
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
ts-transform-readonly-array
Advanced tools
TypeScript transformer to convert 'readonly T[]' to 'ReadonlyArray<T>' in declaration files
TypeScript transformer to convert readonly T[] to ReadonlyArray<T> in declaration files.
Starting from v3.4.0 (or one of the nightly releases before that) TypeScript emits readonly T[] for readonly array types.
This breaks consumers of declaration files if they use an older version of TypeScript.
This transformer ensures that your declaration files can be used in older TypeScript versions as well.
It does not convert readonly tuple types in the form of readonly [string, number] as this is not supported in older versions of TypeScript.
ttypescriptI wrote this transformer for use with ttypescript.
You can configure it in your tsconfig.json:
{
"compilerOptions": {
"declaration": true,
"plugins": [
{ "transform": "ts-transform-readonly-array", "afterDeclarations": true },
]
}
}
Note that you can use any "type" for the transformer: the default is "type": "program", but it also works with "type": "raw" for example.
Afterwards you run ttsc as you would run tsc.
ts-loader, rollup, and TypeScript's APIThis package exports the necessary factory function to create the transformer. You can use this function to plug this transformer in any major TypeScript compilation pipeline.
Please refer to the API documentation of the tool you are using. Alternatively you can use ttypescript in most tools.
FAQs
TypeScript transformer to convert 'readonly T[]' to 'ReadonlyArray<T>' in declaration files
We found that ts-transform-readonly-array demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.