
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This is an event-based dBase file parser for very efficiently reading data from *.dbf files based on the node-dbf package.
To get started, install the module using npm:
npm install bodhi-dbf
and then require it as a function with an options object:
var dbf = require('bodhi-dbf')(/* options */);
#Interface
The package presents an interface with one class (the Parser) and one function createParser
##Parser
This class is the main interface for reading data from dBase files. It extends EventEmitter and its output is via events.
###new Parser(path, /* options */)
String The full path to the .dbf file to parseCreates a new Parser and attaches it to the specified filename.
var parser = new dbf.Parser('/path/to/my/dbase/file.dbf');
###parser.on(event, listener)
String The event name to listen for (see below for details)Function The callback to bind to the eventThis method is inherited from the EventEmitter class.
###parser.parse()
Call this method once you have bound to the events you are interested in. Although it returns the parser object (for chaining), all the dBase data is outputted via events.
parser.parse();
###Event: 'start'
Parser The parser objectThis event is emitted as soon as the parser.parse() method has been invoked.
###Event: 'header'
Header The header object as parsed from the dBase fileThis event is emitted once the header has been parsed from the dBase file
###Event: 'record'
Object An object representing the record that has been foundThe record object will have a key for each field within the record, named after the field. It is trimmed (leading and trailing) of any blank characters (dBase files use \x20 for padding).
In addition to the fields, the object contains two special keys:
Number indicates the order in which it was extractedBoolean whether this record has been deleted or notThis object may look like:
{
"@sequenceNumber": 123,
"@deleted": false,
"firstName": "John",
"lastName": "Smith
}
###Event: 'end'
Parser The parser objectThis event is fired once the dBase parsing is complete and there are no more records remaining.
##Usage
The following code example illustrates a very simple usage for this module:
var dbf = require('bodhi-dbf')(/* {options} */)
var parser = new dbf.Parser('/path/to/my/dbase/file.dbf');
parser.on('start', function(p) {
console.log('dBase file parsing has started');
});
parser.on('header', function(h) {
console.log('dBase file header has been parsed');
});
parser.on('record', function(record) {
console.log('Name: ' + record.firstName + ' ' + record.lastName); # Name: John Smith
});
parser.on('end', function(p) {
console.log('Finished parsing the dBase file');
});
parser.parse();
FAQs
pure JS tools for parsing DBF files
We found that bodhi-dbf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.