
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Ultra-fast, lightweight, general purpose composition engine for Node.js
$ npm i composium
Composium is an easily and incrementally adoptable ultra fast and lightweight general purpose composition engine that targets the Node.js platform as an NPM module.
Unlike templating engines, Composium does not require the use of a templating paradigm and supports advanced logic using ECMAScript and optionally Node.js modules.
Contrived example referencing data with no logic:
const composium = require('composium')
let template = '<presentation>Hi <data>firstName</data>!</presentation>'
composium.loadTemplate('Hi Template', template)
let output = composium.compose('Hi Template', { firstName: 'Sam' })
Templates are comprised of a presentation tag and/or a script tag for logic and for explicit manipulation of the output.
<script>
let name = (data.firstName) ? data.firstName | 'world'
</script>
<presentation>
<p>Hello <variable>name</variable>!</p>
<presentation>
The presentation tag contains a tag-based logicless template for merging copy with data and variables created in a corresponding script tag.
script tag is absentprofileQuick guide
| Tag | Use |
|---|---|
data | <data>name</data> |
else | <if condition="condition">...<else>...</else></if> |
for | <for each="item" in="items">...</for> |
if | <if condition="condition">...</if> |
include | <include>name</include> |
variable | <variable>name</variable |
The script tag contains ECMAScript for template logic and for optionally manipulating the output explicitly.
presentation tag is absentAny variable created in the script tag can be referenced by the variable tag in the presentation.
Quick guide
| Object | Use |
|---|---|
data | data.property[.property] etc |
include | include('templateName') |
output | output.clear() |
output | output.set('string') |
output | output.toString() |
profile | profile.property[.property] etc |
require | require('moduleName') |
workspace | workspace.get('name') |
workspace | workspace.set('name', object) |
The profile provides a mechanism for externalizing behavior for a single compose call.
none)Quick guide
{
name: 'Profile name',
variableEncoding: 'none/xml/html',
dataEncoding: 'none/xml/html',
beforeComposition: ['Template name'],
afterComposition: ['Template name'],
properties: {
samplePropertyName: 'samplePropertyValue'
}
}
FAQs
Composium composition engine
We found that composium demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.