supabase-community/copycat

Generate deterministic fake values: The same input will always generate the same fake-output. Snaplet appears to be a company that recently shut down, but their packages have been maintained in the supabase community space.

Summary

Copycat is a TypeScript library that generates deterministic fake data: for any given input, the same output value is always produced, regardless of environment, process, or call ordering. It is published on npm as @snaplet/copycat and is licensed under MIT.

What it is useful for

The library is designed for cases where you need fake data that is both realistic-looking and stable across runs. The README's primary motivation is anonymizing sensitive records for development and testing, such as replacing real customer emails, names, and phone numbers in a database snapshot with values that look real but do not leak the original information. Because the mapping from input to output is deterministic, foreign keys and other relationships stay consistent: a user with id 42 in production will always anonymize to the same fake user, even after the database schema or the order of inserts changes.

It is also useful for seeding tests with realistic fixtures, generating reproducible mock data for API responses, and building demos where the same data should appear on every run. For PII workflows, the library supports a hash key, so an attacker who can guess the input space still cannot recover original values without that key. The README warns that without a key, repeated calls over a small input dictionary can let an attacker map outputs back to inputs.

How engineers can use it

The README documents the following usage:

import { copycat } from '@snaplet/copycat'

copycat.email('foo')
// => '[email protected]'

copycat.email('foo')
// => '[email protected]' (same value)

The same pattern applies across copycat.firstName, copycat.fullName, copycat.uuid, copycat.phoneNumber, copycat.streetAddress, copycat.scramble, and many other helpers. For PII, generate a key with copycat.generateHashKey('some secret'), store it securely, then call copycat.setHashKey(key) before anonymization runs. copycat.scramble can replace characters in strings and digits in numbers while preserving length and (optionally) certain characters via the preserve option.

When the fake values must also be unique, the README documents copycat.unique and copycat.uniqueByInput, which take a Set-like store. The README explicitly notes that unique is not stateless, not thread-safe, and that uniqueness is probabilistic rather than guaranteed. It also flags that generated phone numbers may not be valid for real dialing and that the password helper is not recommended for personal passwords. For the exact install command, refer to the project README.