Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
By Kush Pandya - Dec 24, 2025
xml
Install
Note, if you're using @xmpp/client or @xmpp/component, you don't need to install @xmpp/xml yourself.
npm install @xmpp/xml or yarn add @xmpp/xml
const xml = require('@xmpp/xml')
const {xml} = require('@xmpp/client')
const {xml} = require('@xmpp/component')
Writing
There's 2 methods for writing XML with xmpp.js
factory
const xml = require('@xmpp/xml')
const recipient = 'user@example.com'
const days = ['Monday', 'Tuesday', 'Wednesday']
const message = xml(
'message',
{to: recipient},
xml('body', {}, 1 + 2),
xml('days', {}, days.map((day, idx) => xml('day', {idx}, day)))
)
JSX
/** @jsx xml */
const xml = require('@xmpp/xml')
const recipient = 'user@example.com'
const days = ['Monday', 'Tuesday']
const message = (
<message to={recipient}>
<body>{1 + 2}</body>
<days>
{days.map((day, idx) => (
<day idx={idx}>${day}</day>
))}
</days>
</message>
)
Requires a preprocessor such as Babel with @babel/plugin-transform-react-jsx.
Reading
attributes
The attrs property is an object that holds xml attributes of the element.
message.attrs.to // user@example.com
text
Returns the text value of an element
message.getChild('body').text() // '3'
getChild
Get child element by name.
message.getChild('body').toString() // '<body>3</body>'
getChildText
Get child element text value.
message.getChildText('body') // '3'
getChildren
Get children elements by name.
message.getChild('days').getChildren('day') // [...]
Since getChildren returns an array, you can use JavaScript array methods such as filter and find to build more complex queries.
const days = message.getChild('days').getChildren('day')
// Find Monday element
days.find(day => day.text() === 'Monday')
days.find(day => day.attrs.idx === 0)
// Find all days after Tuesday
days.filter(day => day.attrs.idx > 2)
Editing
attributes
The attrs property is an object that holds xml attributes of the element.
message.attrs.type = 'chat'
Object.assign(message.attrs, {type: 'chat'})
text
Set the text value of an element
message.getChild('body').text('Hello world')
append
Adds text or element nodes to the last position. Returns the parent.
message.append(xml('foo'))
message.append('bar')
message.append(days.map(day => xml('day', {}, day)))
// <message>
// ...
// <foo/>
// bar
// <day>Monday</day>
// <day>Tuesday</day>
// </message>
prepend
Adds text or element nodes to the first position. Returns the parent.
message.prepend(xml('foo'))
message.prepend('bar')
message.prepend(days.map(day => xml('day', {}, day)))
// <message>
// <day>Tuesday</day>
// <day>Monday</day>
// bar
// <foo/>
// ...
// </message>
remove
Removes a child element.
const body = message.getChild('body')
message.remove(body)
JSON
You can embed JSON anywhere but it is recommended to use an appropriate semantic.
/** @jsx xml */
// write
message.append(
<myevent xmlns="xmpp:example.org">
<json xmlns="urn:xmpp:json:0">{JSON.stringify(days)}</json>
</myevent>
)
// read
JSON.parse(
message
.getChild('myevent', 'xmpp:example.org')
.getChildText('json', 'urn:xmpp:json:0')
)
See JSON Containers
FAQs
XMPP XML for JavaScript
We found that @xmpp/xml demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 07 Jan 2019
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Security News
Engineering with AI Podcast: The Promise of AI-First Development
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.
By Sarah Gooding - Dec 24, 2025
Research
/Security News
Spearphishing Campaign Abuses npm Registry to Target U.S. and Allied Manufacturing and Healthcare Organizations
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.
By Nicholas Anderson, Kirill Boychenko - Dec 23, 2025