
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
escape-mkdn
Advanced tools
A little utility to find escaped ranges in markdown files -- useful for narrowing results when parsing with regex.
Install with npm:
npm install escape-mkdn
If you're parsing markdown with some regular expressions instead of a proper parser, match results will sometimes be too greedy:
Here is some text with a [[wikilink]] -- we want this to be parsed.
Here is some text with an `escaped [[wikilink]]` -- we do not want this to be parsed.
Simple regular expressions will capture both [[wikilink]] instances, which is potentially not what we want if we are, say, searching for active wikilinks to make them clickable. The escape-mkdn utility will find the escaped [[wikilink]], so when we perform our regex match we can check the escaped results to identify matches we want to ignore.
The previous example might then be searched in the following manner:
import { escapedIndices } from 'escape-mkdn';
let content: string = `
Here is some text with a [[wikilink]] -- we want this to be parsed.
Here is some text with an \`escaped [[wikilink]]\` -- we do not want this to be parsed.
`;
let escapedIndices: number[] = escIndices(content);
let match: RegExpExecArray | null;
do {
match = RGX.WIKI.LINK.exec(content);
if (match) {
// only print results if the match was not escaped
if (!escapedIndices.includes(match.index)) {
console.log(match);
}
}
} while (match);
isIndexEscaped(content: string, index: number): booleanReturns true if the index is inside of an escaped range in the given content string or false if not.
content: stringA string representing the content to search.
index: numberA number representing an index
isStrEscaped(str: string, content: string, offset: number = 0, escIndices: number[] = []): booleanReturns true if the given string is escaped in the given content string. The first instance of the str will be used unless an offset is given, in which case the first instance after the offset will be inspected.
str: stringThe string to check if is within an escaped range.
content: stringA content string to search.
offset: number = 0An offset to start from -- this is useful when there may be multiple instances of the given str, but instances that occur later in content are to be inspected. The default is 0.
escIndices: number[] = []The indices to check the target str against for escape status. It is useful to provide this array when calling this function multiple times over the same content. The default is an empty array that is populated dynamically from the given content string.
escIndices(content: string): number[]Returns an array of numbers that represent all indices that are escaped in the given content string (includes indices of the escape chars themselves).
content: stringesc(str: string): stringAn extra utility to escape regex reserved chars in a given string (similar to escape-regex-str).
str: stringThe string containing regular expression characters to be escaped.
The following are examples of escape types this module will search for. Ranges will include the escape characters themselves as well as the content within in the escaped range.
indented by 4+ spaces or a tab
```
...with backticks
```
~~~
...with tildes
~~~
Some text with a `code span`.
$$
...with dollar signs.
$$
$Some text with a $math span$.
FAQs
identify escaped indices and characters in markdown.
We found that escape-mkdn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.