
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
alpha-stringify
Advanced tools
Serialize anything, and sort keys for equality comparison.
yarn add alpha-stringify
npm install alpha-stringify
import stringify from "alpha-stringify";
const cache = new Map();
function memoizedFunction(x: any) {
if(cache.has(stringify(x))) {
return cache.get(stringify(x));
} else {
cache.set(stringify(x), x);
}
}
import stringify from "alpha-stringify";
// Some primitives behave the same as JSON.stringify:
stringify(true); // true
stringify("test"); // "test"
stringify(null); // null
// Numbers use the `.toString()` method instead, which helps with Infinity and NaN:
stringify(1); // 1
stringify(Infinity); // Infinity
stringify(NaN); // NaN
// Other types are serialized as they would be written in JavaScript:
stringify(BigInt(9007199254740991)); // BigInt(9007199254740991)
stringify(Symbol("Sym")); // Symbol("Sym")
stringify(new Date()); // new Date(1619932122057)
stringify(/test/); // /test/
stringify(new RegExp(/test/)); // /test/
stringify(new Set(["a", "b"])); // new Set(["a","b"])
stringify(new Map([["a", 1], ["b", 2]])); // new Map([["a",1],["b",2]])
// There are a few exceptions to this rule though:
stringify(new Error("ok")); // Error: ok
stringify(new WeakSet([{ a: 1, b: 2 }])); // [object WeakSet]
stringify(new WeakMap([[{ a: 1 }, "b"]])); // [object WeakMap]
stringify(new Promise(() => {})); // [object Promise]
// Arrays are not sorted by default, but can be with the `sortArrays` option:
stringify(["b", "a"]); // ["b","a"]
stringify(["b", "a"], { sortArrays: true }); // ["a","b"]
// Objects are sorted by default, but can be disabled with the `sortObjects` option:
stringify({ b: 1, a: 2 }); // {"a":2,"b":1}
stringify({ b: 1, a: 2 }, { sortObjects: false }); // {"b":1,"a":2}
// Functions and are also supported:
stringify(() => 5); // () => 5
stringify(function testFunction() { return 5; }); // function testFunction() { return 5; }
stringify(console.info); // function () { [native code] }
// Classes are stringified to their constructor, plus value:
class TestClass {
constructor(color: string) {
this.color = color;
}
getColor() {
return this.color.toUpperCase();
}
}
stringify(new TestClass("red"));
// class TestClass {
// constructor(color) {
// this.color = color;
// }
// getColor() {
// return this.color.toUpperCase();
// }
// }
// '{"color":"red"}'
// Other edge cases:
stringify(undefined); // undefined
stringify(globalThis); // globalThis
stringify(Math); // Math
// Circular dependencies are supported:
const x = { a: 1 };
x.b = x;
stringify(x); // {"a":1,"b":[Circular]}
import stringify, { Options } from "alpha-stringify";
function stringify(value: any, options?: Options): string;
type Options = {
/**
* Sort object keys. Default: `true`.
*/
sortObjects?: boolean;
/**
* Sort array items. Default: `false`.
*/
sortArrays?: boolean;
};
FAQs
Serialize anything, and sort keys for equality comparison
The npm package alpha-stringify receives a total of 0 weekly downloads. As such, alpha-stringify popularity was classified as not popular.
We found that alpha-stringify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.