
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
type-safe-prompt
Advanced tools
A lightweight library for handling prompts with embeddable variables in a type-safe manner
type-safe-prompt is a lightweight library for handling prompts with embeddable variables in a type-safe manner.
The package is available on the npm registry. You can install it using your preferred package manager:
$ npm install type-safe-prompt
# or
$ yarn add type-safe-prompt
# or
$ pnpm add type-safe-prompt
Define your prompt template using a constant:
const prompt = `
You are {{name}}, a {{role}}.
Please respond politely to user requests.
`
Use the fillPrompt function to embed variables into the template. This provides type safety for variable specification:
import { fillPrompt } from "type-safe-prompt"
// This will cause a type error because the required variables 'role' and 'name' are missing
const filledPrompt = fillPrompt(prompt, {})
// This will also cause a type error due to missing required variables and an incorrect variable name
const filledPrompt = fillPrompt(prompt, {
miss: "Alice",
})
When there are no type errors, you can see the resolved prompt text at the type level:
const filledPrompt = fillPrompt(prompt, {
name: "Alice",
role: "Engineer",
}) // => "\nYou are Alice, a Engineer.\nPlease respond politely to user requests.\n"
This is useful as it allows you to verify the content of the resolved prompt without actually executing the code at runtime.
When defining templates with embeddable variables, you might first think of using template literals like this:
const myPrompt = (vars: { [K in "name"]: readonly string }) => {
return `
your name is ${vars.name}
`
}
This library does essentially the same thing, but makes this pattern more convenient and easier to implement.
Benefits of using type-safe-prompt:
If these benefits don't appeal to you, you might not need type-safe-prompt. If you're not concerned about indentation and prefer to avoid additional dependencies over the verbosity of writing functions, using plain template literals might be a better choice.
This project is licensed under the MIT License.
Contributions are welcome!
FAQs
A lightweight library for handling prompts with embeddable variables in a type-safe manner
We found that type-safe-prompt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.