
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
typescript-workspace-plugin
Advanced tools
Simple plugin that adds support for yarn-like workspaces to typescript
Add the plugin to all your tsconfig.json files of the individual packages:
{
"plugins": [{"name": "typescript-workspace-plugin"}]
}
Then at the toplevel package.json alongside yarn's "workspaces" entry, add a "workspace-sources" entry:
{
"workspaces": ["packages/*"],
"workspace-sources": {
"*": ["packages/*/src"]
}
}
The field works exatly like the "paths" field in tsconfig.json but it only affects the language service of the individual projects, pointing them to the package sources. Restores proper "go to definition / type" functionality and similar.
Once you install and configure the plugin, make sure to switch to the workspace version of typescript installed with your project! Otherwise, the plugin will not be loaded.
From cmd+shift+p (ctrl+shift+p), type in:
If it still doesn't work after that, a cmd+shift+p -> Reload afterwards might help.
The packages still have their individual tsconfig.json
They can have separate repos and be cloned and developed completely independent of the master workspace like e.g. prosemirror: https://github.com/ProseMirror/prosemirror
When cloned independently, "go to definition" and "find references" functionality will behave as if the dependencies are standard node modules (definition files available only)
FAQs
typescript workspace - language services plugin
We found that typescript-workspace-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.