
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
code-stringify
Advanced tools
code-stringify is node.js module that converts JavaScript variables into source codes. Unlike JSON.stringify, code-stringify converts things into strings of code, not JSON.
code-stringify is the node.js module that converts JavaScript variables into source codes with indents and styles.
Unlike JSON.stringify, code-stringify also deals with reference(object) types of variables, and it converts JavaScript variables into strings of codes, not JSON.
Supports:
npm i code-stringify
const fs = require('fs')
const stringify = require('code-stringify')
const obj = {
'0': 1,
'a': function(n){return n;},
'b': 1,
'c-d': 3
}
// So you can use code-stringify to save your javascript variables into a file:
fs.writeFileSync(
'output.js',
`module.exports = ${stringify(obj, null, 2)}`
)
Then 'output.js' will look like:
module.exports = {
0: 1,
a: function(n){return n;},
b: 1,
'c-d': 3
}
anyThe subject to be stringified
Function(key, value) | ArrayThe replacer argument acts just like the second parameter of JSON.stringify.
A function that alters the behavior of the stringification process, or an array of String and Number objects that serve as a whitelist for selecting/filtering the properties of the value object to be included in the JSON string. If this value is null or not provided, all properties of the object are included in the resulting JSON string.
stringify({
a: 1,
b: 2
}, function (key, value) {
return key === 'b'
? undefined
: value
})
// '{a:1}'
number | stringThe space argument acts just like the third parameter of JSON.stringify.
number | stringDefaults to 0
The code indent for the entire subject. If indent === 4, then the content of the output.js in the first example will be:
module.exports = {
0: 1,
a: function (n){return n;},
b: 1,
'c-d': 3
}
We could use new code.Code(code_string) to define an already-stringified property.
So, see the example below:
const output = `module.exports = ${stringify({
a: 1,
'foo-bar': 2,
foo: new stringify.Code('(function(a){return a})(3)')
})}`
saveFile(output, 'output.js')
And the output.js will be:
module.exports = {
a: 1,
'foo-bar': 2,
foo: (function(a){return a})(3)
}
stringify.STRINGIFY_SYMBOL// `stringify.STRINGIFY_SYMBOL` equals to
stringify.STRINGIFY_SYMBOL = Symbol.for('code.stringify.custom')
If an object[stringify.STRINGIFY_SYMBOL] is a function, then the function will be used as the stringifier of the object.
const monkey = {
iam: {
[Symbol.for('code.stringify.custom')] () {
return '"monkey king"'
}
}
}
console.log(stringify(monkey))
// {iam:"monkey king"}
JSON.stringify()JSON.stringify makes JSON.code-stringify makes JavaScript code.Advanced Section
const {
Stringifier,
STRINGIFY_SYMBOL,
CODE_STRINGIFY_CUSTOM
} = require('code-stringify')
new in 2.0.0
The constructor Stringifier allows us to take more control of the stringifer.
Object
(Function | Array)=null(number | string)=0 Defaults to 0 which indicates there should be no spaces.' | " the quote character for strings. Defaults to '.boolean=true uses number key of an object if possiblenew Stringifier().stringify({'1': 1, '2b': 2})
// {1:1,'2b':2}
new Stringifier({
useNumberKey: false
}).stringify({'1': 1, '2b': 2})
// {'1':1:'2b':2}
(number | string)=0Returns the JavaScript code string.
CustomStringifierinterface CustomStringifier {
// Test if we could use the custom stringifier
test: Function (subject): boolean
// If the test method returns true,
// then the stringify method will be used.
// Inside the method, we can access the `Stringifier` instance by `this` object, so that we can use the utility methods below
stringify: Function(subject, indent, options): string
}
Register a custom stringifier for certain data type.
class King {
constructor (name) {
this._name = name
}
selfIntroduce () {
return `[king ${this._name}]`
}
}
new Stringifier().register({
test (value) {
return value instanceof Monkey
},
stringify (value) {
return this.string(value.selfIntroduce())
}
})
.stringify({
dinosaur: 'Godzilla',
ape: new King('Kong')
})
// {dinasaur:'Godzilla',ape:'[king Kong]'}
CODE_STRINGIFY_CUSTOMCODE_STRINGIFY_CUSTOM is a built-in CustomStringifier to support stringify.STRINGIFY_SYMBOL.
And a new Stringifier is not registered CODE_STRINGIFY_CUSTOM by default.
The following methods has no type checking and fault tolerance
Make sure every argument that passed into the methods has been type-checked
stringStringify a string
ObjectStringify a string
ArrayStringify an array
keyStringify a property of an object.
space parameter could not affect the code indent inside functions.Those issues or tasks which should be done to enhance the module might be fixed in the future. Or there will be a million thanks if you fork and contribute ~~
FAQs
code-stringify is node.js module that converts JavaScript variables into source codes. Unlike JSON.stringify, code-stringify converts things into strings of code, not JSON.
The npm package code-stringify receives a total of 667 weekly downloads. As such, code-stringify popularity was classified as not popular.
We found that code-stringify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.