tsec

library0.2.9jsnpmunverified

tsec is a static analysis tool built on the TypeScript compiler that validates code against Trusted Types compliance. At version 0.2.9, it provides extended compiler checks to enforce Trusted Types, a browser security primitive that mitigates DOM XSS attacks. Unlike runtime polyfills, tsec catches violations at compile time, integrating into the build pipeline without runtime overhead. It requires Bazel build system (with @bazel/bazelisk and @bazel/concatjs) and TypeScript >=3.9.2. Its key differentiator is compile-time enforcement, making it suitable for large codebases where runtime approaches are insufficient.

auth-security devops

npm install tsec

github ↗package ↗

INSTALL

IMPORT

SIG · TSEC

tsec

auth-securityjavascriptv0.2.9

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import tsec from 'tsec'

✗ const tsec = require('tsec')

ESM-only since v0.2.0, no CommonJS support.

TSECConfig

✓ import { TSECConfig } from 'tsec'

✗ const { TSECConfig } = require('tsec')

Named export for TypeScript config type.

runTsec

✓ import { runTsec } from 'tsec'

✗ import { runTsec } from 'tsec/run'

No subpath exports; all exports are at the package root.

Demonstrates tsec usage as a Bazel test rule, enforcing that no code uses .innerHTML without Trusted Types approval.

// tsec configuration in BUILD.bazel load("@npm//tsec:index.bzl", "tsec_test") tsec_test( name = "tsec_test", srcs = glob(["src/**/*.ts"]), tsconfig = ":tsconfig.json", tsec_config = { "disallowed": ["innerHTML"], "allowed": { "https://trusted.example.com/script.js": ["*"], }, }, ) // Then run: bazel test //:tsec_test

tsec --version

Debug

Known issues

breakingtsec only supports Bazel build system. Non-Bazel users must adapt their build pipeline.

fix

Integrate Bazel or consider alternative trust-checking tools.

affects: >=0.1.0

deprecatedThe 'disallowed' config property is deprecated in favor of 'blocked'.

fix

Rename 'disallowed' to 'blocked' in your tsec config.

affects: >=0.2.0

gotchatsec requires @bazel/bazelisk >=1.7.5 and @bazel/concatjs >=5.3.0, which may conflict with older Bazel setups.

fix

Upgrade Bazel dependencies to minimum versions.

affects: <0.2.0

gotchatsec checks only TypeScript source files; JavaScript or declaration files are not analyzed.

fix

Ensure all relevant code is in .ts files.

affects: >=0.1.0

gotchaESM-only package; require() will fail. Ensure Node.js project uses ESM or bundler that supports ESM.

fix

Use import syntax or upgrade to ESM-compatible runtime.

affects: >=0.2.0

Errors

Common errors & fixes

Error: Cannot find module 'tsec'

Package not installed or missing dependencies.

fix

Run 'npm install tsec' and ensure peer dependencies are installed.

TypeError: tsec is not a function

Using require() instead of import (ESM-only).

fix

Change to 'import tsec from "tsec"' and ensure package.json has 'type':'module'.

Error: Unsupported config property 'disallowed' in tsec config

Config key renamed in newer version.

fix

Replace 'disallowed' with 'blocked' in your tsec configuration.

Error: Bazel build failed: no such attribute 'tsec_test' in rule

Bazel rules not loaded correctly.

fix

Add 'load("@npm//tsec:index.bzl", "tsec_test")' to your BUILD file.

Upgrade

Version history

0.2.9latest on npm

Audit

Dependencies

@bazel/bazeliskrequiredRequired Bazel build launcher for tsec execution

@bazel/concatjsrequiredBazel rules for TypeScript compilation used by tsec

typescriptrequiredPeer dependency for TypeScript compiler, must be >=3.9.2

Agent activity

19 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/google/tsec ↗

packagehttps://www.npmjs.com/package/tsec ↗