Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@paulll/ascii-separated-values
Advanced tools
ASCII (\x1f, \x1e)-separated values file streaming parser/writer
ASCII (\x1f, \x1e)-separated values file streaming parser/writer.
Since almost any CSV parser/writer implementation is different (just look at jqnatividad/qsv: there are different supported syntaxes per command, no consistency at all!), I think there's time for brand new standard.
Just kidding, it isn't even something new, there's always been a Delimiter-Separated Values format, so ASV files should work with any DSV/CSV parser that allows custom field/row delimiters. There are special reserved symbols 'RECORD SEPARATOR' aka \x1e and 'FIELD SEPARATOR' aka \x1f in almost any text encoding, but for some unknown reason everyone just proposes their new standards with complex escaping rules, or even without escaping assuming that there will never be text with their uncommon separator like '|'. Also there are people who also faced such escaping problem, but again offer crutch solutions like using \00 as field separator.
In terms of common CSV/DSV settings:
{
"quote": "never",
"escape": "never",
"delimiter": "\x1f",
"terminator": "\x1e"
}
FAQs
ASCII (\x1f, \x1e)-separated values file streaming parser/writer
The npm package @paulll/ascii-separated-values receives a total of 4 weekly downloads. As such, @paulll/ascii-separated-values popularity was classified as not popular.
We found that @paulll/ascii-separated-values demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.