
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
If eval takes a string representing code, and turns it into actual code, deval takes actual code, and returns a string representation of it.
Browserify/node/commonjs compatible:
npm install deval
Sometimes you're doing fun/evil/interesting things, and you want a block of code as a multiline string. But doing this is super annoying:
var codeString = [
"var foo = 'bar'",
"function stuff () {",
" console.log('The thing is \"10\"');"
"}"
].join('\n');
Quotes everywhere, keeping track of indentation is a pian if you want it properly formatted, no syntax highlighting, bleurgh.
Deval makes it look like this:
var deval = require('deval');
var codeString = deval(function () {
var foo = 'bar';
function stuff () {
console.log('The thing is "10"');
}
});
//codeString -> "var foo = 'bar';\nfunction stuff () {\n console.log('The thing is \"10\"');\n}"
It even figures out what indentation you meant and cleans that up.
Call deval with a function containing the code you want to get back as a string. The function wrapper will be removed.
var deval = require('deval');
var codeString = deval(function () {
var foo = 'bar';
function stuff () {
console.log('The thing is "10"');
}
});
//codeString will be:
// "var foo = 'bar';
// function stuff () {
// console.log('The thing is \"10\"');
// }"
Sometimes you want to interpolate strings/numbers/etc into your generated code. You can't just use normal scoping rules, because this code won't be executed in the current scope. So instead you can do a little templating magic.
To interpolate:
deval(function (arg1, arg2) { ...$arg1$deval(function (arg, arg2) { ... }, "one", 2)var codeString = deval(function (foo, bar) {
var thing = $bar$;
console.log('$foo$');
console.log(thing);
}, "hi", 5);
//codeString will be:
// "var thing = 5;
// console.log('hi');
// console.log(thing)"
note: Don't try to be too clever with this, and if you're passing strings, you'll want to wrap them in quotes inside the code block, as shown about for "hi" -> '$foo$'
MIT
FAQs
Like eval, but backwards.
We found that deval demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.