
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
##About
The cornet is a brass instrument very similar to the trumpet, distinguished by its conical bore, compact shape, and mellower tone quality. - Wikipedia
This project is demonstrating how to use a couple of my libraries to replace substack/node-trumpet in just a couple of LOC.
Even better, there are some advantages over trumpet:
fb55/CSSselect.cornet works as a handler for fb55/htmlparser2, the probably fastest HTML parser currently available for node. And it's much less strict than the sax module used by trumpet.MatthewMueller/cheerio module, you can do everything with your document that would be possible with jQuery.Please note that callbacks are fired as soon as an element was retrieved. That means that no content past the element will be available, so cheerio won't find anything, and, as the element is at this time the last child of it's parent, selectors like :nth-last-child won't work as expected.
##Install
npm install cornet
##Example
var Parser = require("htmlparser2").WritableStream,
Cornet = require("cornet"),
minreq = require("minreq"),
$ = require("cheerio");
var cornet = new Cornet();
minreq.get("http://github.com/fb55").pipe(new Parser(cornet));
cornet.remove("script"); //remove all scripts
//show all repos
cornet.select(".repo_list", function(elem){
$(elem).find("h3").each(function(i){
console.log("repo %d: %s", i + 1, $(this).text().trim());
});
});
//does the same
var i = 0;
cornet.select(".repo_list h3", function(elem){
console.log("repo %d: %s", ++i, $(elem).text().trim());
});
//sometimes, you only want to get a single element
var onTitle = cornet.select("title", function(title){
console.log("Page title:", $(title).text().trim());
cornet.removeLister("element", onTitle);
});
##API
####cornet(options)
The constructor. options are the same you can pass to fb55/DomHandler.
It's an EventEmitter that emits two events:
element is emitted whenever an element was added to the DOM.dom is emitted when the DOM is complete.####cornet#select(selector | fn, cb)
Calls the callback when the selector is matched or a passed function returns true (or any value that evaluates to true).
Internally, listenes for any element event and checks then if the selector is matched.
Returns the listening function, so you can remove it afterwards (as shown in the example above).
####cornet#remove(selector | fn)
Removes all elements that match the selector. Also returns the listener.
FAQs
transform streaming html using css selectors
The npm package cornet receives a total of 56 weekly downloads. As such, cornet popularity was classified as not popular.
We found that cornet demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.