
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
argv-split
Advanced tools
Split argv(argument vector) and handle special cases, such as quoted values.
Split argv(argument vector) and handle special cases, such as quoted or escaped values.
const split = require('split')
const mkdir = 'mkdir "foo bar"'
mkdir.split(' ') // ['mkdir', '"foo', 'bar"'] -> Oops!
split(mkdir) // ['mkdir', 'foo bar'] -> Oh yeah!
const mkdir2 = 'mkdir foo\\ bar'.split(' ')
mkdir2.split(' ') // ['mkdir', 'foo\\', 'bar'] -> Oops!
split(mkdir2) // ['mkdir', 'foo bar'] -> Oh yeah!
argv-split
handles all special cases with complete unit tests.# shell command: javascript array:
foo a\ b # ['foo', 'a b']
foo \' # ['foo', '\\\'']
foo \" # ['foo', '\\"']
foo "a b" # ['foo', 'a b']
foo "a\ b" # ['foo', 'a\\ b']
foo '\' # ['foo', '\\']
foo --abc="a b" # ['foo', '--abc=a b']
foo --abc=a\ b # ['foo', '--abc=a b']
# argv-split also handles carriage returns
foo \
--abc=a\ b # ['foo', '--abc=a b']
# etc
split('foo \\\n --abc=a\\ b') // ['foo', '--abc=a b']
UNMATCHED_SINGLE
If a command missed the closing single quote, the error will throw:
Shell command:
foo --abc 'abc
try {
split('foo --abc \'abc')
} catch (e) {
console.log(e.code) // 'UNMATCHED_SINGLE'
}
UNMATCHED_DOUBLE
If a command missed the closing double quote, the error will throw:
foo --abc "abc
ESCAPED_EOF
If a command unexpectedly ends with a \
, the error will throw:
foo --abc a\# if there is nothing after \, the error will throw
foo --abc a\ # if there is a whitespace after, then -> ['foo', '--abc', 'a ']
NON_STRING
If the argument passed to split
is not a string, the error will throw
split(undefined)
$ npm i argv-split
Splits a string, and balance quoted parts. The usage is quite simple, see examples above.
Returns Array<string>
Join the given array of argument vectors into a valid argument string
New in 3.1.0
Array<string>
arguments to be joinedObject=
string="
should we use single quote or double quote when a certain argument needs to be quoted. Defaults to "
'command ' + join(['foo "bar', "'baz"])
// command "foo \"bar" "'baz"
MIT
FAQs
Split argv(argument vector) and handle special cases, such as quoted values.
The npm package argv-split receives a total of 6,013 weekly downloads. As such, argv-split popularity was classified as popular.
We found that argv-split demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.