
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Helper utility for transforming typescript tests to allow testing for semantics rather than functionality.
# global
npm install -g tsst
# local
npm install tsst --save-dev
Uhh. This is an experimental library/tool/utility/thing to aid testing of TypeScript semantics.
At its core, this is a TypeScript transformer that takes semantic build errors and turns them into runtime errors. Here's the show-don't-tell explanation.
type ZeroOneToBoolean<T extends "0" | "1">
= {"0": false, "1": true}[T];
describe("ZeroOneToBoolean", () => {
it("works with '0'", () => {
type A = ZeroOneToBoolean<"0">;
});
it("works with '1'", () => {
type A = ZeroOneToBoolean<"1">;
});
// This test should fail for demonstration purposes
it("works with the number 0", () => {
type A = ZeroOneToBoolean<0>;
});
});
describe("ZeroOneToBoolean", () => {
it("works with 0", () => {
});
it("works with 1", () => {
});
// This test should fail for demonstration purposes
it("works with the number 0", () => {
throw new Error("Type '0' does not satisfy the constraint '\"0\" | \"1\"'.");
});
});
In this early form, this only tests for successful compilation.
If you install this package globally, you can use tsst
to transform the tests. This is a very basic builder. It uses the local tsconfig.json
and takes a single argument for a test glob.
# global install
tsst "**/*.test.ts"
# local install
node_modules/.bin/tsst "**/*.test.ts"
The TypeScript compiler provides hooks for specifying custom transformers, but tsc
does not expose these. While many common tools like ts-loader are starting to support transformers, most don't yet provide transformers with access to the ts.Program
object that this requires.
I've been messing about with Wallaby.js a bit recently, and tried to get it working with that, to partial success. They were absolutely fantastic about adding support for transformers for me with a feature-request-to-release turn-around time of about 2 hours. Wallaby.js runs and reports the transformed tests correctly, but there are some problems with line numbers and error positions not lining up. I haven't fully pinned these down yet, and am not sure to what degree these issues are solvable by this tool.
FAQs
Helper utility for transforming typescript tests to allow testing for semantics rather than functionality.
The npm package tsst-tycho receives a total of 0 weekly downloads. As such, tsst-tycho popularity was classified as not popular.
We found that tsst-tycho demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.