
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@devgrid/messagepack
Advanced tools
A high-performance MessagePack implementation for Node.js with TypeScript support, custom type extensions, and streaming capabilities.
npm install @devgrid/messagepack
# or
yarn add @devgrid/messagepack
import { encode, decode } from '@devgrid/messagepack';
// Encoding
const data = {
name: "John",
age: 30,
hobbies: ["reading", "gaming"]
};
const encoded = encode(data);
// Decoding
const decoded = decode(encoded);
// Numbers (integers and floats)
encode(42);
encode(3.14);
// Strings
encode("Hello World");
// Booleans
encode(true);
encode(false);
// null
encode(null);
// Arrays
encode([1, 2, 3]);
// Objects
encode({ foo: "bar" });
// Buffer
encode(Buffer.from([1, 2, 3]));
import { serializer } from '@devgrid/messagepack';
// Date
const date = new Date();
const encodedDate = encode(date);
// Map
const map = new Map([["key", "value"]]);
const encodedMap = encode(map);
// Set
const set = new Set([1, 2, 3]);
const encodedSet = encode(set);
// RegExp
const regex = /pattern/g;
const encodedRegex = encode(regex);
// BigInt
const bigint = BigInt("9007199254740991");
const encodedBigInt = encode(bigint);
// Error objects
const error = new Error("Something went wrong");
const encodedError = encode(error);
You can register your own types for serialization:
import { Serializer } from '@devgrid/messagepack';
class User {
constructor(public name: string, public age: number) {}
}
const customSerializer = new Serializer();
// Register custom type (use numbers 1-99 for user-defined types)
customSerializer.register(
1, // type ID
User, // constructor
// Encoder
(obj: User, buf: SmartBuffer) => {
customSerializer.encode(obj.name, buf);
customSerializer.encode(obj.age, buf);
},
// Decoder
(buf: SmartBuffer) => {
const name = customSerializer.decode(buf);
const age = customSerializer.decode(buf);
return new User(name, age);
}
);
// Use custom serializer
const user = new User("John", 30);
const encoded = customSerializer.encode(user);
const decoded = customSerializer.decode(encoded);
The library includes built-in support for serializing standard JavaScript errors:
try {
throw new TypeError("Invalid type");
} catch (error) {
const encoded = encode(error);
const decoded = decode(encoded);
console.log(decoded instanceof TypeError); // true
console.log(decoded.message); // "Invalid type"
console.log(decoded.stack); // Preserved stack trace
}
The library supports streaming via SmartBuffer:
import { SmartBuffer } from '@devgrid/smartbuffer';
import { serializer } from '@devgrid/messagepack';
// Create a buffer
const buf = new SmartBuffer();
// Encode multiple objects
serializer.encode({ type: "header" }, buf);
serializer.encode({ type: "data", content: "..." }, buf);
serializer.encode({ type: "footer" }, buf);
// Decode stream
while (buf.length > 0) {
const result = serializer.decoder.tryDecode(buf);
if (result) {
console.log(result.value);
} else {
break; // Incomplete data
}
}
The library reserves specific type IDs for different purposes:
encode(value: any): Buffer
decode(buffer: Buffer | SmartBuffer): any
tryDecode(buffer: SmartBuffer): { value: any, bytesConsumed: number } | null
class Serializer {
constructor(initialCapacity?: number);
register(type: number, constructor: any, encode: EncodeFunction, decode: DecodeFunction): this;
registerEncoder(type: number, check: CheckFunction, encode: EncodeFunction): this;
registerDecoder(type: number, decode: DecodeFunction): this;
encode(value: any, buffer?: SmartBuffer): SmartBuffer;
decode(buffer: Buffer | SmartBuffer): any;
}
MIT
Built with SmartBuffer for efficient buffer operations.
While this library is primarily designed for Node.js, it can be used in browser environments with proper bundling setup.
// webpack/rollup/esbuild will handle the Buffer polyfill
import { encode, decode } from '@devgrid/messagepack';
// webpack.config.js
module.exports = {
resolve: {
fallback: {
"buffer": require.resolve("buffer/"),
"long": require.resolve("long")
}
},
plugins: [
new webpack.ProvidePlugin({
Buffer: ['buffer', 'Buffer']
})
]
};
// rollup.config.js
import nodePolyfills from 'rollup-plugin-node-polyfills';
export default {
plugins: [
nodePolyfills()
]
};
<!-- Include required polyfills -->
<script src="https://cdn.jsdelivr.net/npm/long/dist/long.js"></script>
<script src="https://cdn.jsdelivr.net/npm/buffer@6.0.3/index.min.js"></script>
<!-- Include bundled messagepack -->
<script src="path/to/bundled/messagepack.js"></script>
<script>
const data = {
name: "John",
numbers: [1, 2, 3],
timestamp: new Date()
};
// Encode data
const encoded = messagepack.encode(data);
// Decode data
const decoded = messagepack.decode(encoded);
</script>
To minimize bundle size when using in browsers:
import { encode, decode } from '@devgrid/messagepack';
// Instead of
import * as messagepack from '@devgrid/messagepack';
FAQs
Extandable MessagePack serializer
We found that @devgrid/messagepack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.