
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@saxs/json-path-transform
Advanced tools
Transforms JSON objects using a path-based approach.
This package provides a simple way to transform JSON objects using a path-based approach.
The purpose is to make it possible to write declarative transformations for json objects, hence make it useable in a configuration file or from user inputs.
Using npm
npm install @saxs/json-path-transform
Using yarn
yarn add @saxs/json-path-transform
Using pnpm
pnpm add @saxs/json-path-transform
The schema defines the transformation rules. The keys are the target keys and the values are the paths to the source keys.
import { PathTransform } from '@saxs/json-path-transform';
const schema = {
name: '$.user.name',
age: '$.user.age',
};
const data = {
user: {
name: 'John Doe',
age: 30,
},
};
const transformer = new PathTransform(schema).compile();
console.log(transformer(data)); // { name: 'John Doe', age: 30 }
The JSONPath syntax is used to define the paths. The package uses the jsonpath-plus package under the hood to resolve the paths.
Exmaples can be found at https://goessner.net/articles/JsonPath/.
The root key can be used to define the root of the object at any given depth. This copies the main object to that level.
import { PathTransform } from '@saxs/json-path-transform';
const schema = {
$: '$.user',
};
const data = {
user: {
name: 'John Doe',
age: 30,
},
};
const transformer = new PathTransform(schema).compile();
console.log(transformer(data)); // { name: 'John Doe', age: 30 }
The performance is dependant on the complexity of the schema and the size of the data. The package makes a AOT compilation of the schema to make the transformation as fast as possible, and uses jsonpath-plus package under to hood to resolve results from each path.
On a M1 Macbook Air (16GB RAM) we can expect the following performance as seen under the benchmark folder.
| Test Name | ops/sec | Confidence Interval |
|---|---|---|
| root | 4,907,733 | ±0.20% |
| allAuthors | 479,267 | ±0.35% |
| allAuthorsDot | 1,007,505 | ±1.30% |
| addKey | 449,904 | ±0.76% |
FAQs
Transform JSON objects using JSONPath syntax
We found that @saxs/json-path-transform demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.