Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The chalk npm package is a popular library for styling and coloring text in the terminal. It provides an easy-to-use API for applying various text styles, such as color, background color, bold, underline, and more, to console output in Node.js applications.
Text color
Change the color of the text. In this example, the text 'Hello world!' will be printed in blue.
console.log(chalk.blue('Hello world!'));
Background color
Change the background color of the text. Here, 'Hello world!' will have a red background.
console.log(chalk.bgRed('Hello world!'));
Text styles
Apply text styles such as bold, italic, underline, etc. This code sample makes the text 'Hello world!' bold.
console.log(chalk.bold('Hello world!'));
Combining styles
Combine multiple styles together. The text 'Hello world!' will be bold with blue text and a red background.
console.log(chalk.blue.bgRed.bold('Hello world!'));
Composing multiple styles
Create reusable composed style functions. This creates an 'error' style that is bold and red, which can be used to print error messages.
const error = chalk.bold.red; console.log(error('Error!'));
Template literals
Use tagged template literals for styling. This allows for more readable code when applying multiple styles.
console.log(chalk`{blue.bold Hello} {red world!}`);
The 'colors' package is similar to chalk and allows for coloring and styling terminal output. Unlike chalk, 'colors' extends String.prototype to add color and style methods directly to strings, which some may find less clean than chalk's functional approach.
The 'cli-color' package provides similar functionality to chalk with a focus on performance. It offers a chainable API and additional features like column alignment and line width control, but it might be more complex to use than chalk.
The 'ansi-styles' package is a lower-level library that chalk itself uses. It provides ANSI escape codes for styling text in the terminal. It's more manual and less user-friendly than chalk but offers more control for those who need it.
While 'ink' is not a direct alternative to chalk, it is a React-based rendering library for interactive command-line apps that includes its own system for styling text. It's more powerful for building full CLI applications but is overkill for simple text styling.
Terminal string styling done right
colors.js used to be the most popular string styling module, but it has serious deficiencies like extending String.prototype
which causes all kinds of problems. Although there are other ones, they either do too much or not enough.
Chalk is a clean and focused alternative.
String.prototype
$ npm install --save chalk
Chalk comes with an easy to use composable API where you just chain and nest the styles you want.
var chalk = require('chalk');
// style a string
chalk.blue('Hello world!');
// combine styled and normal strings
chalk.blue('Hello') + 'World' + chalk.red('!');
// compose multiple styles using the chainable API
chalk.blue.bgRed.bold('Hello world!');
// pass in multiple arguments
chalk.blue('Hello', 'World!', 'Foo', 'bar', 'biz', 'baz');
// nest styles
chalk.red('Hello', chalk.underline.bgBlue('world') + '!');
// nest styles of the same type even (color, underline, background)
chalk.green(
'I am a green line ' +
chalk.blue.underline.bold('with a blue substring') +
' that becomes green again!'
);
Easily define your own themes.
var chalk = require('chalk');
var error = chalk.bold.red;
console.log(error('Error!'));
Take advantage of console.log string substitution.
var name = 'Sindre';
console.log(chalk.green('Hello %s'), name);
//=> Hello Sindre
<style>[.<style>...](string, [string...])
Example: chalk.red.bold.underline('Hello', 'world');
Chain styles and call the last one as a method with a string argument. Order doesn't matter, and later styles take precedent in case of a conflict. This simply means that Chalk.red.yellow.green
is equivalent to Chalk.green
.
Multiple arguments will be separated by space.
Color support is automatically detected, but you can override it by setting the enabled
property. You should however only do this in your own code as it applies globally to all chalk consumers.
If you need to change this in a reusable module create a new instance:
var ctx = new chalk.constructor({enabled: false});
Detect whether the terminal supports color. Used internally and handled for you, but exposed for convenience.
Can be overridden by the user with the flags --color
and --no-color
. For situations where using --color
is not possible, add an environment variable FORCE_COLOR
with any value to force color. Trumps --no-color
.
Exposes the styles as ANSI escape codes.
Generally not useful, but you might need just the .open
or .close
escape code if you're mixing externally styled strings with your own.
var chalk = require('chalk');
console.log(chalk.styles.red);
//=> {open: '\u001b[31m', close: '\u001b[39m'}
console.log(chalk.styles.red.open + 'Hello' + chalk.styles.red.close);
Check whether a string has color.
Strip color from a string.
Can be useful in combination with .supportsColor
to strip color on externally styled text when it's not supported.
Example:
var chalk = require('chalk');
var styledString = getText();
if (!chalk.supportsColor) {
styledString = chalk.stripColor(styledString);
}
reset
bold
dim
italic
(not widely supported)underline
inverse
hidden
strikethrough
(not widely supported)black
red
green
yellow
blue
(on Windows the bright version is used as normal blue is illegible)magenta
cyan
white
gray
bgBlack
bgRed
bgGreen
bgYellow
bgBlue
bgMagenta
bgCyan
bgWhite
Chalk does not support support anything other than the base eight colors, which guarantees it will work on all terminals and systems. Some terminals, specifically xterm
compliant ones, will support the full range of 8-bit colors. For this the lower level ansi-256-colors package can be used.
If you're on Windows, do yourself a favor and use cmder
instead of cmd.exe
.
MIT © Sindre Sorhus
FAQs
Terminal string styling done right
The npm package chalk receives a total of 246,362,964 weekly downloads. As such, chalk popularity was classified as popular.
We found that chalk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.