
Security News
Cline CLI npm Package Compromised via Suspected Cache Poisoning Attack
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.
tiny-warning
Advanced tools
A tiny warning alternative.
import warning from 'tiny-warning';
warning(truthyValue, 'This should not log a warning');
warning(falsyValue, 'This should log a warning');
// console.warn('Warning: This should log a warning');
(condition: mixed, message: string) => voidcondition is required and can be anythingmessage is an required string that will be passed onto console.warntiny-warning?The library: warning supports passing in arguments to the warning function in a sprintf style (condition, format, a, b, c, d, e, f). It has internal logic to execute the sprintf substitutions. tiny-warning has dropped all of the sprintf logic. tiny-warning allows you to pass a single string message. With template literals there is really no need for a custom message formatter to be built into the library. If you need a multi part message you can just do this: warning(condition, 'Hello, ${name} - how are you today?')
warning for kb savings!We recommend using babel-plugin-dev-expression to remove warning calls from your production build. This saves you kb's as well as avoids logging warnings to the console for production.
What it does it turn your code that looks like this:
warning(condition, 'My cool message that takes up a lot of kbs');
Into this
if ('production' !== process.env.NODE_ENV) {
warning(condition, 'My cool message that takes up a lot of kbs');
}
Your bundler can then drop the code in the "production" !== process.env.NODE_ENV block for your production builds
Final result:
// nothing to see here! 👍
For
rollupuse rollup-plugin-replace and setNODE_ENVtoproductionand thenrollupwill treeshake out the unused code
es (EcmaScript module) build (because you know you want to deduplicate this super heavy library)cjs (CommonJS) buildumd (Universal module definition) build in case you needed itWe expect process.env.NODE_ENV to be available at module compilation. We cache this value
🤘
The 'warning' package is similar to 'tiny-warning' and serves the same purpose of logging warning messages to the console under certain conditions. It is slightly larger in size compared to 'tiny-warning' but offers a very similar API and functionality.
While 'prop-types' is primarily used for type checking React component props, it also provides warning messages in development if the types do not match the expected types. It is different from 'tiny-warning' in that it is more specialized for React and includes type validation, but it shares the concept of development-only warnings.
The 'invariant' package is used to assert that a condition is met, and if not, it will throw an error in both development and production. It is different from 'tiny-warning' which only logs warnings and does not throw. 'Invariant' is more suitable for critical conditions that should halt execution if not met.
FAQs
A tiny warning function
The npm package tiny-warning receives a total of 8,831,482 weekly downloads. As such, tiny-warning popularity was classified as popular.
We found that tiny-warning demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.

Product
Socket now supports PHP with full Composer and Packagist integration, enabling developers to search packages, generate SBOMs, and protect their PHP dependencies from supply chain threats.