Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The async-csv npm package provides asynchronous methods for parsing and stringifying CSV data. It is designed to handle CSV operations in a non-blocking manner, making it suitable for applications that require high performance and scalability.
Parsing CSV
This feature allows you to parse a CSV string into an array of records asynchronously. The code sample reads a CSV file and parses its content into an array of records.
const fs = require('fs');
const { parse } = require('async-csv');
(async () => {
const csvString = await fs.promises.readFile('path/to/file.csv', 'utf-8');
const records = await parse(csvString);
console.log(records);
})();
Stringifying CSV
This feature allows you to convert an array of records into a CSV string asynchronously. The code sample takes an array of records and writes it to a CSV file.
const fs = require('fs');
const { stringify } = require('async-csv');
(async () => {
const records = [
['name', 'age'],
['Alice', 30],
['Bob', 25]
];
const csvString = await stringify(records);
await fs.promises.writeFile('path/to/output.csv', csvString);
})();
The csv-parser package is a streaming CSV parser that can handle large CSV files efficiently. Unlike async-csv, which is designed for asynchronous operations, csv-parser focuses on streaming data, making it suitable for processing large files without loading them entirely into memory.
The fast-csv package provides both parsing and formatting capabilities for CSV data. It supports both synchronous and asynchronous operations and offers a wide range of configuration options. Compared to async-csv, fast-csv is more feature-rich and flexible but may have a steeper learning curve.
The papaparse package is a powerful CSV parser that works in both Node.js and browser environments. It supports asynchronous parsing and can handle large files through chunking. While async-csv is focused on Node.js, papaparse offers cross-environment compatibility and additional features like data validation.
This is a wrapper for the popular csv
package in NPM that can be used with the ES7 async-await pattern, instead of using callbacks.
const csv = require('async-csv');
const fs = require('fs').promises;
(async() => {
// Read file from disk:
const csvString = await fs.readFile('./test.csv', 'utf-8');
// Convert CSV string into rows:
const rows = await csv.parse(csvString);
})();
For all documentation, please see the documentation for the csv package.
All parameters are the same as for the functions in the csv
module, except that you need to omit the callback parameter.
If there is any error returned by the csv
package, an exception will be thrown.
const csv = require('async-csv');
// `options` are optional
let result1 = await csv.generate(options);
let result2 = await csv.parse(input, options);
let result3 = await csv.transform(data, handler, options);
let result4 = await csv.stringify(data, options);
Feedback, bug reports and pull requests are welcome. See the linked Github repository.
FAQs
ES7 async-await wrapper for the csv package.
The npm package async-csv receives a total of 167,626 weekly downloads. As such, async-csv popularity was classified as popular.
We found that async-csv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.