Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

3 TypeScript patterns I keep stealing from open-source codebases

Every few months I find a TypeScript pattern in someone's open-source repo that I instantly bring back to my own code. It's the cheapest form of getting better — read code that's been read by hundreds of contributors and find the patterns t…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Every few months I find a TypeScript pattern in someone's open-source repo that I instantly bring back to my own code. It's the cheapest form of getting better — read code that's been read by hundreds of contributors and find the patterns that survived.



Here are three I keep reaching for in 2026.






1. satisfies for catch-typos-at-compile-time configs



You know the routine — a config object that holds, say, all your route paths, or all your event names. You want autocomplete when you reference one, but you also want TS to scream if you fat-finger a key.



The old way:




type RouteKey = 'home' | 'blog' | 'profile';
type Routes = Record<RouteKey, string>;

export const routes: Routes = {
home: '/',
blog: '/blog',
profile: '/profile',
};

routes.home; // type is `string` — autocomplete works, but you lose the literal






The satisfies way:




export const routes = {
home: '/',
blog: '/blog',
profile: '/profile',
} satisfies Record<string, string>;

routes.home; // type is the literal '/', not just string






satisfies checks the shape but preserves the specific inferred types of every key and value. If I refer to routes.home, TS knows the value is '/', not just string. Useful when those literals drive other types downstream:




type Path = (typeof routes)[keyof typeof routes];
// Path is '/' | '/blog' | '/profile' — not string






I stole this from a Remix codebase last year. It's in every project I touch now.






2. Branded types to stop ID confusion



Ever passed userId where postId was expected? TypeScript won't catch it, because both are strings.




function getUser(id: string) { /* ... */ }
function getPost(id: string) { /* ... */ }

const userId = 'u_abc';
const postId = 'p_xyz';

getUser(postId); // no error — the bug ships






Brand them and the bug becomes unrepresentable:




type Brand<T, B> = T & { __brand: B };

type UserId = Brand<string, 'UserId'>;
type PostId = Brand<string, 'PostId'>;

function asUserId(s: string): UserId { return s as UserId; }
function asPostId(s: string): PostId { return s as PostId; }

function getUser(id: UserId) { /* ... */ }
function getPost(id: PostId) { /* ... */ }

const userId = asUserId('u_abc');
const postId = asPostId('p_xyz');

getUser(postId); // Error: 'PostId' is not assignable to 'UserId'






The branding is a zero-cost lie — UserId is really just string at runtime — but the compiler treats them as different types. The asUserId helper is the only blessed entry point, so all the unsafe casting happens in one place you can audit.



I picked this up from a fintech repo where mixing up OrderId and TradeId would have been a five-figure mistake. For a side project it's overkill. For anything touching money or user data, I reach for it instantly.






3. Discriminated unions with a kind field



This isn't new, but I use it more than any other pattern on this list, so it belongs.



State that can be in one of several modes — loading / success / error, draft / published / archived, free / pro / enterprise — should be a discriminated union, not three optional booleans.



The painful way:




interface FetchState<T> {
data?: T;
error?: string;
isLoading?: boolean;
}

if (state.data) {
// might still be loading? unclear
// might have a stale error? also unclear
}






The clean way:




type FetchState<T> =
| { kind: 'idle' }
| { kind: 'loading' }
| { kind: 'success'; data: T }
| { kind: 'error'; error: string };

function render(state: FetchState<User>) {
switch (state.kind) {
case 'idle': return null;
case 'loading': return <Spinner />;
case 'success': return <Profile user={state.data} />; // data is typed
case 'error': return <ErrorMessage msg={state.error} />; // error is typed
}
}






Inside each case block, TS narrows the type for you. state.data exists in 'success' and nowhere else. You can't accidentally read it from 'loading' because it isn't on that variant.



The kind field name is convention. Some teams use type, some use status. Pick one, use it everywhere — switching the discriminator name across files makes every code review harder than it needs to be.






What I'd skip



Decorator-heavy patterns. Stage-3 decorators are stable in TS 5+, but every project I've used them in eventually hit a corner where they didn't compose well with the framework's lifecycle. I've gone back to plain functions and higher-order helpers and never missed the magic.






The meta lesson



Reading open-source isn't just for inspiration. It's professional development without the bootcamp tuition. Every pattern in this list survived hundreds of contributors making small calls — that's a stronger filter than my own taste alone.



If you haven't already, pick one TypeScript codebase you admire and read 30 minutes of source this week. Try to spot a pattern you don't already use. Steal it. Use it on Monday.



That's how you get better — one stolen pattern at a time.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - 3 TypeScript patterns I keep stealing from open-source codebases
id: 54e1251b-6e96-4dd6-8d87-ce912c32d798
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "3 TypeScript patterns I keep s" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("3 TypeScript patterns I keep stealing fr")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*3 TypeScript patterns I keep stealing fr*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "3 TypeScript patterns I keep stealing fr"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich 3 TypeScript patterns I keep stealing fr.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten 3 TypeScript patterns I keep stealing from open-source codebases

Thematisch verwandte Begriffe: TypeScript, patterns, keep, stealing · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100503 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerabil…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag