
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
docx-mergex
Advanced tools
Merge multiple .docx files into one — with formatting preserved — using pure Node.js.
No Python. No LibreOffice. Just ZIP-level OpenXML parsing and reassembly.
npx docx-mergex <input-folder> [output.docx]
<input-folder>: directory containing your .docx files[output.docx]: (optional) output filename (defaults to merged.docx)Example:
npx docx-mergex ./my-docx-folder merged.docx
Files are merged in alphabetical order by filename.
const mergeDocx = require("docx-mergex");
mergeDocx("./docs", "combined.docx")
.then(() => console.log("✅ Merge complete"))
.catch(err => console.error("❌ Merge failed:", err));
./docs: folder containing .docx files"combined.docx": desired output pathword/document.xml contents are merged — headers, footers, and numbering beyond the body are not preserved.docx (e.g. Word exports, Google Docs exports).docx files and hidden folders are skipped silently| Error | Cause | Solution |
|---|---|---|
EISDIR: illegal operation on directory | Output path is a directory, not a file | Provide a valid .docx filename |
| The XML document isn’t in Word format | Merged XML is malformed or ZIP structure broken | Ensure input docs are valid; update module |
No .docx files found | Input folder contains no .docx files | Check folder path and file extension |
Link the module (from its folder):
npm link
In your test folder, link it in:
npm link docx-mergex
Prepare sample docs:
mkdir test-docs
cp ~/Downloads/*.docx test-docs/
Run the CLI:
docx-mergex ./test-docs merged.docx
Verify in Microsoft Word or LibreOffice.
To unlink after testing:
# In test folder
npm unlink docx-mergex
# In module folder
npm unlink
We welcome contributions!
Fork this repo
Run npm install
Make your changes (add features, fix bugs)
Test via:
node bin/cli.js <input> <output>
Submit a Pull Request with a clear description of your changes
MIT © 2025 Huzaifa Azim
FAQs
Merge .docx files with formatting preserved (pure Node.js)
We found that docx-mergex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.