
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
crystallize
Advanced tools
Turn a flat object into a nested tree-like one, based on matching prefixes amongst its keys.
crystallize() turns a flat data object into a nested, tree-like object. Keys get automatically grouped together if they share matching prefixes.
crystallize() provides 1 way to store JSON-like data in a flat memory structure (e.g. relational tables, CSV). Upon reading from memory, crystallize() deserializes your flat record into a structured object.
This library is approximately 90% complete. The following features remain on the roadmap:
crystallize() (probably crystallize.smash())However, a good serializing substitute for now is flat.
Strikethroughed lines below describe features that are planned but not yet implemented. Everything else works.
var crystallize = require('crystallize');
// The data to crystallize.
var flatBob = {
id: 1,
name: 'bob',
content_description: 'bob is a traveling salesman',
content_tagline: 'the handsomest salesman in the world',
vehicles_air: 'diy quadrocopter',
vehicles_land_bike: 'fixie',
vehicles_land_car: 'jalopy'
};
var nestedBob = crystallize(flatBob);
/*
nestedBob:
{
id: 1,
name: 'bob',
content: {
description: 'bob is a traveling salesman',
tagline: 'the handsomest salesman in the world'
},
vehicles: {
air: 'diy quadrocopter',
land: {
bike: 'fixie',
car: 'jalopy'
}
}
}
*/
Returns the nested version of flatObject. Pass in an optional options object.
Note: Object key order will not be preserved. Rather, keys will end up being lexicographically ordered. File an issue describing your use case if you need object key order preserved.
Options
delimiter
String value that specifies the delimiter between words. '_' and '.' are common. Multi-character delimiters like To delimit by PascalCase/camelCase, supply either '__' (double underscore) are allowed as well.'pascalcase' or 'camelcase'. (default: '_')
excludes
Array of prefix words excluded from crystallizing. One common example is 'is'. See example below. For excluded phrases, either supply the phrase in the appropriate delimitation standard (e.g. 'stateOf' when delimiter is 'camelCase'), or supply the phrase an array of words (e.g. ['state', 'of'], has the advantage of being delimiter-agnostic). (default: [])
var data = {
id: 1,
name: 'bob',
content_description: 'bob is a traveling salesman',
content_tagline: 'the handsomest salesman in the world',
is_live: true,
is_public: true,
hair_is_black: true,
hair_is_silky: true
}
// Exclusion example.
var result = crystallize(data, {excludes: ['is']})
/*
Result:
{
id: 1,
name: 'bob',
content: {
description: 'bob is a traveling salesman',
tagline: 'the handsomest salesman in the world'
},
is_live: true, // Excluded, starts with 'is'.
is_public: true,
hair_is: { // Not excluded, 'is' isn't first word.
black: true,
silky: true
}
}
*/
// Exclusion of phrases.
crystallize(data, {exclude: ['is', 'has', 'state_of']}); // Assuming '_' delimiter.
crystallize(data, {exclude: ['is', 'has', 'stateOf']}); // Assuming camelCase delimiter.
crystallize(data, {exclude: ['is', 'has', ['state', 'of']]});
These situations usually shouldn't be happening. But for the sake of completeness...
FAQs
Turn a flat object into a nested tree-like one, based on matching prefixes amongst its keys.
We found that crystallize demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.