
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
Core engine to convert extended MDAST to DOCX. Supports plugins for footnotes, images, lists, tables, and more. Designed for seamless Markdown-to-DOCX conversion.

The core engine that powers
mdast2docxβ convert Markdown Abstract Syntax Trees (MDAST) into DOCX effortlessly.
Note: With a lean core, functionality can be extended via plugins such as
@m2d/html,@m2d/image,@m2d/table, etc.
pnpm install @m2d/core
or
yarn add @m2d/core
or
npm add @m2d/core
import { toDocx } from "@m2d/core";
const docxBlob = await toDocx(mdast, docxProps, sectionProps);
@m2d/core supports both official and community plugins to extend its capabilities. For example:
import { toDocx } from "@m2d/core";
import { imagePlugin } from "@m2d/image";
await toDocx(mdast, docxProps, {
plugins: [imagePlugin()],
});
π Use only the plugins you need for better performance and bundle size. π§ You can use official plugins, or build your own custom ones to keep the bundle size minimal and functionality scoped.
@m2d/core official plugins:| Plugin | Package | Purpose |
|---|---|---|
| HTML | @m2d/html | Handle raw HTML nodes |
| Image | @m2d/image | Embed images in DOCX |
| Math | @m2d/math | Render LaTeX math |
| Table | @m2d/table | Markdown tables |
| List | @m2d/list | Advanced list formatting |
| Extended MDAST | @m2d/mdast | Extended mdast types |
toDocx(astInputs, docxProps, defaultSectionProps, outputType?)| Param | Type | Description |
|---|---|---|
astInputs | Root or { ast: Root; props?: ISectionProps }[] | The parsed Markdown AST |
docxProps (optional) | IDocxProps | Document metadata and style |
defaultSectionProps (optional) | ISectionProps | Default layout configuration for sections |
outputType (optional) | OutputType | (defaults to 'blob') |
Returns a Promise resolving to a DOCX Blob, Buffer, or Base64 string.
The ISectionProps interface extends DOCX section options with additional MDAST conversion properties:
interface ISectionProps {
// DOCX section properties (headers, footers, page settings, etc.)
// ... all ISectionOptions properties except 'children'
// MDAST to DOCX conversion properties
useTitle?: boolean; // H1 as title, H2 as Heading1, etc. (default: true)
plugins?: Array<IPlugin>; // Plugins to extend conversion functionality
trimInnerSpaces?: boolean; // Trim multiple whitespaces in text (default: true)
footnoteProps?: MutableParaOptions & MutableRunOptions; // Custom footnote styling
}
Key Properties:
useTitle - Controls heading hierarchy mapping (default: true)plugins - Array of plugins to extend conversion capabilitiestrimInnerSpaces - Normalizes whitespace in text nodes (default: true)footnoteProps - Custom paragraph and run styling for footnote contentAI tools often generate Markdown β @m2d/core helps convert them into rich DOCX reports or presentations. This is useful in:
This library is especially useful in:
β Works both on client side and server side β offload to browser or use high-performance Node.js.
git clone https://github.com/tiny-md/mdast2docx
cd mdast2docx/m2d/core
pnpm install
pnpm dev
Licensed under the MPL-2.0 License.
If you find this useful:
Made with π by Mayank Kumar Chaudhari
with
@m2d/core, bring structure, style, and extensibility to your Markdown-to-DOCX pipeline.
FAQs
Core engine to convert extended MDAST to DOCX. Supports plugins for footnotes, images, lists, tables, and more. Designed for seamless Markdown-to-DOCX conversion.
The npm package @m2d/core receives a total of 14,241 weekly downloads. As such, @m2d/core popularity was classified as popular.
We found that @m2d/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.