
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
date-format
Advanced tools
node.js formatting of Date objects as strings. Probably exactly the same as some other library out there.
npm install date-format
var format = require('date-format');
format.asString(); // defaults to ISO8601 format and current date
format.asString(new Date()); // defaults to ISO8601 format
format.asString('hh:mm:ss.SSS', new Date()); // just the time
format.asString(format.ISO8601_WITH_TZ_OFFSET_FORMAT, new Date()); // in ISO8601 with timezone
or
var format = require('date-format');
format(); // defaults to ISO8601 format and current date
format(new Date()); // defaults to ISO8601 format
format('hh:mm:ss.SSS', new Date()); // just the time
format(format.ISO8601_WITH_TZ_OFFSET_FORMAT, new Date()); // in ISO8601 with timezone
output:
2017-03-14T14:10:20.391
2017-03-14T14:10:20.391
14:10:20.391
2017-03-14T14:10:20.391+11:00
Format string can be anything, but the following letters will be replaced (and leading zeroes added if necessary):
date.getDate()date.getMonth() + 1date.getFullYear().toString().substring(2, 4)date.getFullYear()date.getHours()date.getMinutes()date.getSeconds()date.getMilliseconds()Built-in formats:
format.ISO8601_FORMAT - 2017-03-14T14:10:20.391 (local time used)format.ISO8601_WITH_TZ_OFFSET_FORMAT - 2017-03-14T14:10:20.391+11:00 (local + TZ used)format.DATETIME_FORMAT - 14 03 2017 14:10:20.391 (local time used)format.ABSOLUTETIME_FORMAT - 14:10:20.391 (local time used)The date format library has limited ability to parse strings into dates. It can convert strings created using date format patterns (as above), but if you're looking for anything more sophisticated than that you should probably look for a better library (momentjs does pretty much everything).
var format = require('date-format');
// pass in the format of the string as first argument
format.parse(format.ISO8601_FORMAT, '2017-03-14T14:10:20.391');
format.parse(format.ISO8601_WITH_TZ_OFFSET_FORMAT, '2017-03-14T14:10:20.391+1100');
format.parse(format.ISO8601_WITH_TZ_OFFSET_FORMAT, '2017-03-14T14:10:20.391+11:00');
format.parse(format.ISO8601_WITH_TZ_OFFSET_FORMAT, '2017-03-14T03:10:20.391Z');
// returns Date
Moment.js is a widely-used library for parsing, validating, manipulating, and formatting dates in JavaScript. It offers a more extensive set of features compared to date-format, including time zone support and relative time formatting.
date-fns is a modern JavaScript date utility library that provides a comprehensive set of functions for working with dates. It is modular, allowing you to import only the functions you need, which can help reduce bundle size compared to moment.js.
Luxon is a library for working with dates and times in JavaScript. It is built on top of the native JavaScript Date object and provides a more modern API compared to moment.js. Luxon also includes support for time zones and internationalization.
FAQs
Formatting Date objects as strings since 2013
The npm package date-format receives a total of 3,310,618 weekly downloads. As such, date-format popularity was classified as popular.
We found that date-format demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.