
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@stdlib/string-base-format-tokenize
Advanced tools
Tokenize a string into an array of string parts and format identifier objects.
We believe in a future in which the web is a preferred environment for numerical computation. To help realize this future, we've built stdlib. stdlib is a standard library, with an emphasis on numerical and scientific computation, written in JavaScript (and C) for execution in browsers and in Node.js.
The library is fully decomposable, being architected in such a way that you can swap out and mix and match APIs and functionality to cater to your exact preferences and use cases.
When you use stdlib, you can be absolutely certain that you are using the most thorough, rigorous, well-written, studied, documented, tested, measured, and high-quality code out there.
To join us in bringing numerical computing to the web, get started by checking us out on GitHub, and please consider financially supporting stdlib. We greatly appreciate your continued support!
Tokenize a string into an array of string parts and format identifier objects.
npm install @stdlib/string-base-format-tokenize
var formatTokenize = require( '@stdlib/string-base-format-tokenize' );
Tokenizes a string into an array of string parts and format identifier objects.
var str = 'Hello, %s! My name is %s.';
var out = formatTokenize( str );
// returns [ 'Hello, ', {...}, '! My name is ', {...}, '.' ]
The format identifier objects have the following properties:
| property | description |
|---|---|
| specifier | format specifier (single alphabetical character, lower- or uppercase) |
| flags | format flags (string with any of '0', ' ', '+', '-', '#') |
| width | minimum field width (integer or '*') |
| precision | precision (integer or '*') |
| mapping | positional mapping from format specifier to argument index |
var formatTokenize = require( '@stdlib/string-base-format-tokenize' );
var out = formatTokenize( 'Hello %s!' );
// returns [ 'Hello ', {...}, '!' ]
out = formatTokenize( 'Pi: ~%.2f' );
// returns [ 'Pi: ~', {...} ]
out = formatTokenize( 'Multiple flags: %#+s' );
// returns [ 'Multiple flags: ', {...} ]
@stdlib/string-base/format-interpolate: generate string from a token array by interpolating values.This package is part of stdlib, a standard library for JavaScript and Node.js, with an emphasis on numerical and scientific computing. The library provides a collection of robust, high performance libraries for mathematics, statistics, streams, utilities, and more.
For more information on the project, filing bug reports and feature requests, and guidance on how to develop stdlib, see the main project repository.
See LICENSE.
Copyright © 2016-2026. The Stdlib Authors.
FAQs
Tokenize a string into an array of string parts and format identifier objects.
The npm package @stdlib/string-base-format-tokenize receives a total of 605,702 weekly downloads. As such, @stdlib/string-base-format-tokenize popularity was classified as popular.
We found that @stdlib/string-base-format-tokenize demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.