← Projects002 / Library / 2026

stix

A TypeScript library for STIX 2.1, the threat intelligence exchange format. Typed interfaces and Zod runtime validation for every object in the spec.

Fig. 00 · stix, rendered 1-bit

What it is

STIX 2.1 (Structured Threat Information Expression) is the standard format security teams use to share threat intelligence: indicators, malware, attack patterns, and the relationships between them.

stix covers the whole specification in TypeScript: every domain object, relationship object, cyber-observable and meta object has a type definition and a matching Zod schema. Data coming from a feed can be validated at runtime, and code that builds STIX objects is checked by the compiler.

Highlights

  • Complete STIX 2.1 coverage: SDOs, SROs, SCOs and meta objects.
  • Strict TypeScript types and Zod schemas for every object type.
  • Helpers for ID generation, timestamps, bundles and readable validation errors.
  • Zod is the only runtime dependency.
  • More than 2,600 tests, with 100% line, branch and function coverage.

Example

import { IndicatorSchema, generateStixId, getCurrentTimestamp } from "@octavelaventure/stix";

const indicator = IndicatorSchema.parse({
  type: "indicator",
  spec_version: "2.1",
  id: generateStixId("indicator"),
  created: getCurrentTimestamp(),
  modified: getCurrentTimestamp(),
  name: "Malicious file hash",
  pattern: "[file:hashes.MD5 = 'd41d8cd98f00b204e9800998ecf8427e']",
  pattern_type: "stix",
  valid_from: getCurrentTimestamp(),
});

Install

npm install @octavelaventure/stix