
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
esserializer
Advanced tools
ESSerializer is a JavaScript serialization and deserialization utility.
With ESSerializer, you can serialize JavaScript class instance in JSON format, and later on deserialize it into an instance object, with all Class/Property/Method etc. retained, recursively. This works in both browser and Node.js environment. ESSerializer also support almost all builtin classes and types.
No eval
is used during serialization or deserialization. ESSerializer does not introduce any security risk.
ESSerializer offers following features:
Object.defineProperty()
or Object.defineProperties
.$ npm install esserializer --save
For ES6:
import ESSerializer from 'esserializer';
Or for CommonJS:
const ESSerializer = require('esserializer');
To serialize JavaScript object, invoke ESSerializer's serialize
method:
const ClassA = require('./ClassA');
const obj = new ClassA();
// do something here, such as obj.methodOfClassA()
const serializedString = ESSerializer.serialize(obj);
To deserialize text and turn it into a corresponding instance object, invoke ESSerializer's deserialize
method,
with all involved custom classes as parameter (you don't need to include builtin classes such as Date
in this parameter):
const ESSerializer = require('esserializer');
const ClassA = require('./ClassA');
const ClassB = require('./ClassB');
const ClassC = require('./ClassC');
const deserializedObj = ESSerializer.deserialize(serializedString, [ClassA, ClassB, ClassC]);
You can also make ESSerializer detecting those involved custom classes automatically, please check Advanced usage for detail.
Please check the demo page for all examples:
You can also pass an options object during serialization and ignore unwanted properties, or intercept target properties:
const serializedString = ESSerializer.serialize(obj, {
ignoreProperties: ['unwantedFieldX', 'unwantedFieldY'],
interceptProperties: {
propertyX: function (value) {
return value + 1; // After serialization, value of propertyX would be equal to its original value plus 1. Also, "this" can be used here to represent obj.
}
}
});
Serialization options:
Option | Type | Description |
---|---|---|
ignoreProperties | Array | Array of string, represent all properties that would be ignored. |
interceptProperties | Object | Object whose key represents property to be intercepted, and its Function value represents how to intercept. The function would take properties' original value as its first parameter. |
You can also register some classes globally for deserialization. Once class is registered, it will be remembered by ESSerializer in all files:
ESSerializer.registerClasses([ClassA, ClassB, ClassC]);
const deserializedObj = ESSerializer.deserialize(serializedString);
Or, you can let ESSerializer intercept require operation and detect classes automatically. Once class is detected, it will be remembered by ESSerializer in all files:
ESSerializer.interceptRequire();
require('./ClassA');
require('./ClassB');
require('./ClassC');
const deserializedObj = ESSerializer.deserialize(serializedString);
Custom-Classes-Parameter / Class-Registry / Require-Interception, these 3 methods can be used in combination during deserialzation.
During deserialization, you can also pass an options object to indicate which fields of parsed object can be used as constructor parameters:
const User = require('./User');
const serializedString = '{"idNum":"P123456","name":"Mike","ess_cn":"User"}';
const deserializedObj = ESSerializer.deserialize(serializedString, [User], {
fieldsForConstructorParameters: ['idNum', 'name']
}); // value of field 'idNum' ('P123456') and 'name' ('Mike') will be used as constructor parameters to initialize User instance.
Deserialization options:
Option | Type | Description |
---|---|---|
fieldsForConstructorParameters | Array | Array of string, represent fields of parsed object whose value would be used as constructor parameters. |
ignoreProperties | Array | Array of string, represent all properties that would be ignored. |
rawProperties | Array | Array of string, represent all properties whose raw text value would be retained in deserialization result. |
With a cup of coffee ($5), you can download & update ESSerializer Pro and get following additional features:
Please contact shaochuancs@gmail.com if you are interested.
(The MIT License for ESSerializer and private license for ESSerializer Pro)
Copyright (c) 2019-2023 Chuan Shao <shaochuancs@gmail.com>
FAQs
JavaScript serialization and deserialization utility
The npm package esserializer receives a total of 1,242 weekly downloads. As such, esserializer popularity was classified as popular.
We found that esserializer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.