Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
achilles-csv-parser
Advanced tools
A minimal and fast CSV parser for Node.js or a web browser, without any dependencies.
A minimal and fast CSV parser for Node.js or a web browser, without any dependencies. Satisfies the following requirements:
;
instead of comma for the value
separator.If you are curious about the story behind achilles-csv-parser
, have a look at
this blog post
documenting how and why it came to existence.
If you want to quickly test achilles-csv-parser
with various inputs, or just
need an easy-to-use, 100% private online CSV to JSON converter, you should
use Achilles CSV to JSON Converter,
which was created to showcase achilles-csv-parser
.
achilles-csv-parser
API is inspired by the native
JSON.parse
API.
The API is kept purposefully very small, and there is no desire to add bells and whistles (streaming parsing, events, reading/writing directly from/to files) in future versions.
It consists of a single public parse
function with the following signature.
parse(
csv: string,
reviver?: (key: string, value: string) => any,
options?: ParserOptions): Object[]
where options
is an optional parameter with the following format
interface ParserOptions {
separator: ',' | ';';
}
The options
parameter can be used to parse CSV files that deviate from
RFC 4180 by using semicolons
as the value separator instead of a commas. When options
is not provided,
comma ,
is used as the default separator. Specifying any separator other than
comma ,
or semicolon ;
will result in a runtime error being thrown.
There is no command line interface. The tool can only be invoked programmatically as shown below.
Basic usage (without a reviver function)
import {parse} from './node_modules/achilles-csv-parser/dist/esm/parser.min.js';
const csv = `
column1,column2,column3
value1,value2,value3`;
// Parse |csv| string to a JavaScript object.
console.log(parse(csv));
const csvSemicolons = `
column1;column2;column3
value1;value2;value3`;
// Parse |csvSemicolons| string to a JavaScript object.
console.log(parse(csvSemicolons, null, {separator: ';'));
Advanced usage (with a reviver function)
import {parse} from './node_modules/achilles-csv-parser/dist/esm/parser.min.js';
const csv = `
column1,column2,column3
value1,value2,value3`;
// Leverage the optional reviver function parameter to omit all values
// correspending to "column2" from the end result.
const obj = parse(csv, (key, value) => key === 'column2' ? undefined : value));
console.log(obj);
Whichever value is returned from the reviver function will be placed in the
final result, or if undefined
is returned (as in the example above) the value
will be omitted.
To download via NPM use the following command
npm install achilles-csv-parser --only=prod
The entire NPM package is 26.4kB (including LICENSE.txt, README.md, package.json files) and does not pull in any dependencies in production.
There is only one minified JS file distributed which should work both in modern
Node.js versions (supporting JS modules)
and any modern browser. You can find it in the
node_modules/achilles-csv-parser/dist/
folder. The file is fairly small, only
686 bytes before any compression (excluding license header).
686 dist/esm/parser.min.js # Same file for both Node.js or a web browser
Because RFC 4180 does not specify how to handle invalid inputs, there is no "CSV input invalid" error. The algorithm currently will keep charging ahead until it blows up or until it consumes all the input. In many cases of invalid CSV input, it will simply produce some nonsensical output (a.k.a. undefined behavior).
This is likely to be improved in future versions, so that an error is thrown for obviously invalid inputs.
Firstly, install any development dependencies with npm install
. Then execute
the commands below.
Produce distributed files in dist/
folder.
gulp clean
gulp release
Build tests
gulp tsc --target=tests
Run tests
gulp test --target=parser
As of this writing, there is no concrete plan on accepting community contributions, mostly because of other time commitments. Having said that, any PRs or bugs filed are greatly appreciated and will be considered as time permits.
achilles-csv-parser
in production?That's up to you to decide. Firstly, this project is published using the Apache-2.0 license. Secondly, it is provided as-is, with no SLAs on fixing any bugs within a certain timeline. If your project can be satisfied by the requirements stated above, about which CSV strings can be parsed (basically strings adhering to RFC 4180 + semicolon separator), then why not. It might make sense to wait until the "Known Issue" mentioned above, about better invalid input handling is addressed, or do any validation on your end, before passing any CSV strings to this library.
With all that said, I hope you enjoy parsing your CSV strings.
v1.1.0(2023-02-24)
FAQs
A minimal and fast CSV parser for Node.js or a web browser, without any dependencies.
The npm package achilles-csv-parser receives a total of 38 weekly downloads. As such, achilles-csv-parser popularity was classified as not popular.
We found that achilles-csv-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.