
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@dfinity/cbor
Advanced tools
A small implementation of Concise Binary Object Representation (CBOR) in pure JavaScript.
A small implementation of Concise Binary Object Representation (CBOR) in pure JavaScript.
Note: this package is not 100% compatible with the CBOR specification. See the Not implemented section for more details.
Using npm:
npm install @dfinity/cbor
Using pnpm:
pnpm add @dfinity/cbor
Using yarn:
yarn add @dfinity/cbor
Simple:
import { encode, decode } from '@dfinity/cbor';
const value = true;
const encoded = encode(value); // returns `Uint8Array [245]` (which is "F5" in hex)
const decoded = decode(encoded); // returns `true`
With replacer/reviver:
import { encode, decode, type Replacer, type Reviver } from '@dfinity/cbor';
const value = { a: 1, b: 2 };
// Encoding with replacer
const replacer: Replacer = val => (typeof val === 'number' ? val * 2 : val);
const result = encode(value, replacer);
decode(result); // { a: 2, b: 4 }
// Decoding with reviver
const bytes = encode(value);
const reviver: Reviver = val => (typeof val === 'number' ? val * 2 : val);
decode(bytes, reviver); // { a: 2, b: 4 }
Decodes a CBOR byte array into a value. See {@link Reviver} for more information.
| Function | Type |
|---|---|
decode | <T extends unknown = any>(input: Uint8Array<ArrayBufferLike>, reviver?: Reviver<T> or undefined) => T |
Parameters:
input: - The CBOR byte array to decode.reviver: - A function that can be used to manipulate the decoded value.Examples:
Simple
const value = true;
const encoded = encode(value); // returns `Uint8Array [245]` (which is "F5" in hex)
const decoded = decode(encoded); // returns `true`
Reviver
const bytes = ...; // Uint8Array corresponding to the CBOR encoding of `{ a: 1, b: 2 }`
const reviver: Reviver = val => (typeof val === 'number' ? val * 2 : val);
decode(bytes, reviver); // returns `{ a: 2, b: 4 }`
Encodes a value into a CBOR byte array.
| Function | Type |
|---|---|
encode | <T = any>(value: CborValue<T>, replacer?: Replacer<T> or undefined) => Uint8Array<ArrayBufferLike> |
Parameters:
value: - The value to encode.replacer: - A function that can be used to manipulate the input before it is encoded.Examples:
Simple
const value = true;
const encoded = encode(value); // returns `Uint8Array [245]` (which is "F5" in hex)
Replacer
const replacer: Replacer = val => (typeof val === 'number' ? val * 2 : val);
encode({ a: 1, b: 2 }, replacer); // returns the Uint8Array corresponding to the CBOR encoding of `{ a: 2, b: 4 }`
Encodes a value into a CBOR byte array (same as {@link encode}), but prepends the self-described CBOR tag (55799).
| Function | Type |
|---|---|
encodeWithSelfDescribedTag | <T = any>(value: CborValue<T>, replacer?: Replacer<T> or undefined) => Uint8Array<ArrayBufferLike> |
Parameters:
value: - The value to encode.replacer: - A function that can be used to manipulate the input before it is encoded.Examples:
const value = true;
const encoded = encodeWithSelfDescribedTag(value); // returns the Uint8Array [217, 217, 247, 245] (which is "D9D9F7F5" in hex)
The tag number 55799, the self-described tag for CBOR.
The serialization of this tag's head is 0xd9d9f7.
| Constant | Type |
|---|---|
CBOR_SELF_DESCRIBED_TAG | 55799 |
| Constant | Type |
|---|---|
CBOR_STOP_CODE | unique symbol |
| Constant | Type |
|---|---|
TOKEN_VALUE_MAX | 23 |
| Constant | Type |
|---|---|
ONE_BYTE_MAX | 255 |
| Constant | Type |
|---|---|
TWO_BYTES_MAX | 65535 |
| Constant | Type |
|---|---|
FOUR_BYTES_MAX | 4294967295 |
The maximum value that can be encoded in 8 bytes: 18446744073709551615n.
| Constant | Type |
|---|---|
EIGHT_BYTES_MAX | bigint |
| Property | Type | Description |
|---|---|---|
False | 0x14 | |
True | 0x15 | |
Null | 0x16 | |
Undefined | 0x17 | |
Break | 0x1f |
| Property | Type | Description |
|---|---|---|
UnsignedInteger | 0 | |
NegativeInteger | 1 | |
ByteString | 2 | |
TextString | 3 | |
Array | 4 | |
Map | 5 | |
Tag | 6 | |
Simple | 7 |
| Property | Type | Description |
|---|---|---|
Value | 23 | |
OneByte | 24 | |
TwoBytes | 25 | |
FourBytes | 26 | |
EightBytes | 27 | |
Indefinite | 31 |
18,446,744,073,709,551,615. The tests cover a string length that's encoded up to four 4 bytes, longer than this and the tests became extremely slow.2,147,483,647 which would represent the length of an ~2gb string, which is not possible to fit into a single IC message anyway.Check out the contribution guidelines.
pnpm install
pnpm test
pnpm format
We use tsdoc-markdown to generate the documentation.
To update the documentation in the README.md file, run:
pnpm tsdoc
This project is licensed under the Apache License 2.0.
FAQs
A small implementation of Concise Binary Object Representation (CBOR) in pure JavaScript.
The npm package @dfinity/cbor receives a total of 29,078 weekly downloads. As such, @dfinity/cbor popularity was classified as popular.
We found that @dfinity/cbor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.