
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
@streamparser/json-node
Advanced tools
Streaming JSON parser in Javascript for Node.js, Deno and the browser
Fast dependency-free library to parse a JSON stream using utf-8 encoding in Node.js, Deno or any modern browser. Fully compliant with the JSON spec and JSON.parse(...)
.
tldr;
import { JSONParserĀ } from '@streamparser/json-node';
const parser = new JSONParser();
inputStream.pipe(jsonparser).pipe(destinationStream);
// Or using events to get the values
parser.on("data", (value) => { /* ... */ });
parser.on("error", err => { /* ... */ });
parser.on("end", () => { /* ... */ });
There are multiple flavours of @streamparser:
@streamparser/json
into a WHATWG TransformStream.@streamparser/json
into a node Transform stream.A JSON compliant tokenizer that parses a utf-8 stream into JSON tokens that are emitted as objects.
import { TokenizerĀ } from '@streamparser/json-node';
const tokenizer = new Tokenizer(opts, transformOpts);
Transform options take the standard node Transform stream settings (see Node docs).
The available options are:
{
stringBufferSize: <number>, // set to 0 to don't buffer. Min valid value is 4.
numberBufferSize: <number>, // set to 0 to don't buffer.
separator: <string>, // separator between object. For example `\n` for nd-js.
}
If buffer sizes are set to anything else than zero, instead of using a string to apppend the data as it comes in, the data is buffered using a TypedArray. A reasonable size could be 64 * 1024
(64 KB).
When parsing strings or numbers, the parser needs to gather the data in-memory until the whole value is ready.
Strings are inmutable in Javascript so every string operation creates a new string. The V8 engine, behind Node, Deno and most modern browsers, performs a many different types of optimization. One of this optimizations is to over-allocate memory when it detects many string concatenations. This increases significatly the memory consumption and can easily exhaust your memory when parsing JSON containing very large strings or numbers. For those cases, the parser can buffer the characters using a TypedArray. This requires encoding/decoding from/to the buffer into an actual string once the value is ready. This is done using the TextEncoder
and TextDecoder
APIs. Unfortunately, these APIs creates a significant overhead when the strings are small so should be used only when strictly necessary.
A token parser that processes JSON tokens as emitted by the Tokenizer
and emits JSON values/objects.
import { TokenParser} from '@streamparser/json-node';
const tokenParser = new TokenParser(opts, writableStrategy, readableStrategy);
Transform options take the standard node Transform stream settings (see Node docs).
The available options are:
{
paths: <string[]>,
keepStack: <boolean>, // whether to keep all the properties in the stack
separator: <string>, // separator between object. For example `\n` for nd-js. If left empty or set to undefined, the token parser will end after parsing the first object. To parse multiple object without any delimiter just set it to the empty string `''`.
}
undefined
which emits everything. The paths are intended to suppot jsonpath although at the time being it only supports the root object selector ($
) and subproperties selectors including wildcards ($.a
, $.*
, $.a.b
, , $.*.b
, etc).true
. When set to false
the it does preserve properties in the parent object some ancestor will be emitted. This means that the parent object passed to the onValue
function will be empty, which doesn't reflect the truth, but it's more memory-efficient.The full blown JSON parser. It basically chains a Tokenizer
and a TokenParser
.
import { JSONParserĀ } from '@streamparser/json-node';
const parser = new JSONParser();
You can use both components independently as
const tokenizer = new Tokenizer(opts);
const tokenParser = new TokenParser();
const jsonParser = tokenizer.pipeTrough(tokenParser);
You can subscribe to the resulting data using the
import { JSONParserĀ } from '@streamparser/json-node';
const parser = new JSONParser({ stringBufferSize: undefined, paths: ['$'] });
inputStream.pipe(jsonparser).pipe(destinationStream);
// Or using events to get the values
parser.on("data", (value) => { /* ... */ });
parser.on("error", err => { /* ... */ });
parser.on("end", () => { /* ... */ });
Imagine an endpoint that send a large amount of JSON objects one after the other ({"id":1}{"id":2}{"id":3}...
).
import { JSONParser} from '@streamparser/json-node';
const parser = new JSONParser();
const response = await fetch('http://example.com/');
const reader = response.body.pipe(parser);
reader.on('data', value => /* process element */)
Imagine an endpoint that send a large amount of JSON objects one after the other ([{"id":1},{"id":2},{"id":3},...]
).
import { JSONParserĀ } from '@streamparser/json-node';
const parser = new JSONParser({ stringBufferSize: undefined, paths: ['$.*'], keepStack: false });
const response = await fetch('http://example.com/');
const reader = response.body.pipe(parse)getReader();
reader.on('data', ({ value, key, parent, stack }) => /* process element */)
See [LICENSE.md].
FAQs
Streaming JSON parser in Javascript for Node.js, Deno and the browser
The npm package @streamparser/json-node receives a total of 11,123 weekly downloads. As such, @streamparser/json-node popularity was classified as popular.
We found that @streamparser/json-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Ā It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.