
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@office-open/pptx
Advanced tools
Generate, parse, and patch .pptx presentations with a declarative TypeScript API
Generate and parse .pptx presentations with a declarative TypeScript API. Works in Node.js and browsers.
parsePresentation for round-trip workflows# pnpm
pnpm add @office-open/pptx
# npm
npm install @office-open/pptx
# yarn
yarn add @office-open/pptx
# bun
bun add @office-open/pptx
import { Presentation, Shape, Packer, Paragraph, TextRun } from "@office-open/pptx";
import { writeFileSync } from "node:fs";
const pres = new Presentation({
slides: [
{
children: [
new Shape({
textBody: { children: [new Paragraph({ children: [new TextRun("Hello World")] })] },
fill: "4472C4",
x: 100,
y: 100,
width: 600,
height: 400,
}),
],
},
],
});
const buffer = await Packer.toBuffer(pres);
writeFileSync("presentation.pptx", buffer);
Read existing .pptx files and re-create them as PresentationOptions:
import { parsePresentation, Presentation, Packer } from "@office-open/pptx";
import { readFileSync, writeFileSync } from "node:fs";
const opts = parsePresentation(new Uint8Array(readFileSync("input.pptx")));
// Modify parsed data, then re-generate
const pres = new Presentation(opts);
const buffer = await Packer.toBuffer(pres);
writeFileSync("output.pptx", buffer);
Performance vs PptxGenJS (higher ops/s is better, Windows 11 / Node 24).
Default = XML DEFLATE level 1 (SuperFast, matching MS Office) + media STORE. All STORE = no compression ({ compression: { xml: 0 } }). PptxGenJS (async only) defaults to STORE (via JSZip), supports DEFLATE via compression: true (applies to ALL entries including images).
// Default (matches MS Office)
await Packer.toBuffer(pres);
// All STORE (no compression)
await Packer.toBuffer(pres, { compression: { xml: 0 } });
Create + toBuffer (end-to-end)
| Scenario | Default sync | Default async | All STORE sync | All STORE async | PptxGenJS |
|---|---|---|---|---|---|
| Simple (2 shapes) | 1,154 ops/s | 561 ops/s | 2,788 ops/s | 2,236 ops/s | 176 ops/s |
| Styled shapes (20) | 944 ops/s | 563 ops/s | 2,274 ops/s | 2,379 ops/s | 143 ops/s |
| Table (10x5) | 1,747 ops/s | 659 ops/s | 5,305 ops/s | 5,196 ops/s | 659 ops/s |
| Full featured | 762 ops/s | 482 ops/s | 1,605 ops/s | 1,451 ops/s | 75 ops/s |
Large Files — Create + toBuffer
| Scenario | Default sync | Default async | All STORE sync | All STORE async | PptxGenJS |
|---|---|---|---|---|---|
| 30 slides x 20 shapes | 133 ops/s | 85 ops/s | 211 ops/s | 242 ops/s | 91 ops/s |
| 30 slides x 10 images | 10.1 ops/s | 9.88 ops/s | 10.2 ops/s | 10.1 ops/s | 0.35 ops/s |
| 100x10 table | 502 ops/s | 369 ops/s | 698 ops/s | 704 ops/s | 119 ops/s |
| 50 slides full | 25.1 ops/s | 20.3 ops/s | 26.9 ops/s | 26.1 ops/s | 1.02 ops/s |
Large File (~100MB) — Mixed Content
40 slides x (2 shapes + 2 mixed-size images + 3x3 table). Speedup is vs PptxGenJS.
| Method | Speed | Speedup |
|---|---|---|
| Default | 8.0 ops/s | 26.7x |
| All STORE | 8.2 ops/s | 27.4x |
| PptxGenJS | 0.30 ops/s |
Check the demo folder for working examples covering every feature.
FAQs
Generate, parse, and patch .pptx presentations with a declarative TypeScript API
The npm package @office-open/pptx receives a total of 397 weekly downloads. As such, @office-open/pptx popularity was classified as not popular.
We found that @office-open/pptx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.