Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
We defined at Theodo quality by the "3S quality factor" that the code:
We think that a team needs the following to be able to deliver code of high quality:
The goal of tyrion is to help you on the last point "🌡 Be able to measure quality".
We defined technical debt as every piece of code or architecture that prevents quality. Through various experiments, we saw that when we were monitoring the evolution of the technical debt it was more likely to prevent it to increase. We tried different ways of managing and measuring it in the past (Trello cards, google docs, post-it, ..) but we never found a painless solution that would allow us to:
So we created Tyrion. You can now:
You need to use tyrion with node v12 or v14. It is not currently working with superior version mainly because problems with the main tool with use: NodeGit.
Install Tyrion globally: npm i -g tyrionl
(yes, tyrionl
with a final l
, it's not a typo).
Run tyrion
with the following options
-p, --path [scanDirectory] The path of the directory you want to analyse
-e, --evolution [days] Get the evolution of the debt since X days
-b, --branch [days] Specify the branch used for the evolution analysis. (Default to master)
-n, --nobrowser [browser] Don't open the report after being generated
-c, --csv [csv] export the debt data into a csv file
-d, --devs [devs] Get information about who is contributing the most to quality (Beta)
-h, --help output usage information
Example:
tyrion -p ./src -c
to get the current debt score and create a csv reporttyrion --evolution 28 -p .
to get the evolution of the debt during 28 days starting from the last commit.tyrion --evolution 28 -b prod -p .
to get the evolution of the debt during 28 days starting from the last commit of the prod branch.You can use either the following debt tag for the same result: @debt
, TODO
, FIXME
.
Tyrion parses the files looking for comments that follows the following convention:
/**
* @debt DEBT_TYPE:SUB_TYPE
*/
There is a default score for the following DEBT_TYPE:
You don't need to specify a SUB_TYPE, so a minimum example can be:
/**
* @debt quality
*/
You can add a comment to provide more details about the debt item by following this convention:
/**
* @debt DEBT_TYPE:SUB_TYPE "Author: comment"
*/
A complete example could be:
/**
* @debt security:sql-injection "Maximet: The request is not escaped when being called from the command"
*/
The parser will look for all lines containing '@debt' and starting either by *
or #
which should cover most web programing languages.
You can override the default pricing of debt items by creating a .tyrion-config.json
file in the root directory of your project. You can even create your own types. Here is the default one:
{
"pricer": {
"bug": 100,
"architecture": 100,
"bugRisk": 5,
"security": 100,
"securityRisk": 10,
"quality": 5,
"test": 5,
"doc": 3,
"ci": 30,
"deploy": 10,
"devEnv": 10,
"outdated": 5
},
"standard": 100,
"ignorePath": [
"node_modules",
"README.md"
],
"debtTags": [
"@debt",
"TODO",
"FIXME"
]
}
You can also mark some files as being "Joconde" a file that follows perfectly the standard of code quality.
You can use either the following tag for the same result: @best
, @standard
, JOCONDE
.
Example: // JOCONDE React:component "The standard can be find here: http....."
You can ignore files containing certain strings by using the "ignorePath"
option in the config file:
"ignorePath": [
"node_modules",
"README.md"
]
You can change the default debt tags used to detect which comment line should be consider as a debt comment by Tyrion. To do so override the debtTags
entry in .tyrion-config.json
:
"debtTags": [
"@debt",
"TODO",
"FIXME"
]
This function is not available anymore as it wasn't used.
You can filter the result by any type of debt you want with the option --filter
.
It will compare the type and the string you pass as an argument after filter.
Example: tyrion -p ./src --filter bug
FAQs
technical debt collector tool
The npm package tyrionl receives a total of 36 weekly downloads. As such, tyrionl popularity was classified as not popular.
We found that tyrionl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.