
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
This is a NodeJS/Deno module for making .docx files from scratch or from
an existing DOCX/DOTX template.
You could use docxml to:
This documentation for this lib is available at various locations:
👉 Documentation site
👉 GitHub source
👉 Deno mirror
👉 npm mirror
docxml can be used in NodeJS and Deno according to the traditions in those
ecosystems. For Node users, simply npm install docxml and then require() or import as you wish. For Deno users,
import "deno.land/x/docxml/mod.ts" or use an import map if you wish.
// NodeJS using CommonJS:
const { default: Docxml, Paragraph } = require('docxml');
// NodeJS using ES6 modules, or Deno with an import map
import Docxml, { Paragraph } from 'docxml';
// Deno without an import map
import Docxml, { Paragraph } from 'https://deno.land/x/docxml/mod.ts';
docxml is designed to be used in vanilla JavaScript using class component instances, or using JSX if you're on Deno or
want to use NodeJS and a transpiler like Babel:
const para = new Paragraph({ alignment: 'center' }, new Text({}, 'I want a cookie'));
/** @jsx Docx.jsx */
const para = (
<Paragraph alignment="center">
<Text>I want a cookie</Text>
</Paragraph>
);
docxml is also designed to be used from scratch/entirely programmatically, or using a more ergonomic API
to transform from an XML document. Both modes work equally well with vanilla JS or JSX.
await Docx.fromJsx(
<Paragraph alignment="center">
<Text>I want a cookie</Text>
</Paragraph>,
).toFile('example-1.docx');
await Docx.fromNothing()
.withXmlRule('self::text()', ({ node }) => <Text>{node.nodeValue}</Text>)
.withXmlRule('self::p', ({ traverse, node }) => (
<Paragraph alignment={node.getAttribute('align')}>{traverse()}</Paragraph>
))
.withXml(`<p align="center">I want a cookie</p>`, {})
.toFile('example-2.docx');
To great or small extend, the following features work in the current version of docxml. Some items are not ticked off
yet -- they are not available, but hopefully soon.
👉 See code examples of some or the more intricate features
API features:
Custom styles:
References:
Tables:
Images:
UInt8Array sourceSections:
Comments:
Change tracking:
Obviously docxml is a TypeScript project, which is already very different from how you would normally interact
with a DOCX document. More meaningfully however, docxml is meant to make writing DOCX easier than going straight
to OOXML. For example;
Length, which means it doesn't matter wether you input them as points, centimeters,
inches, 1/2, 1/8th or 1/20th points, English Metric Units, and so on.<Text> when using JSX. This makes the configuration of a new DOCX a little more
forgiving.<Image> or <Comment> components will automatically create all required relationships etc.docxml is more verbose than the DOCX verbiage.docxml prefers formal (JS) references over references-by-identifier. In those cases the
identifiers are randomly generated for you when the .docx file is written.This project uses unit tests and linting for quality control. To lint, both Deno's own linting as well as ESLint are used. Please run both of the following commands to ensure that a GitHub Action does not fail later.
# Once
npm install
# Run all unit tests
deno task test
# Run all linting
deno task lint
FAQs
TypeScript (component) library for building and parsing a DOCX file
The npm package docxml receives a total of 157 weekly downloads. As such, docxml popularity was classified as not popular.
We found that docxml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.