Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Fast and light parser for TOML 0.5, an alternative to JSON or YAML file formats.
fast-toml
is the fastest and lightest Javascript parser for TOML files (see benchmarks below).
TOML stands for Tom's Obvious and Minimal Language and it is an awesome language for your configuration files, better than JSON and YAML on many aspects. Learn here what is TOML and how to use it (it's definitely worth the ten minutes learning).
First, install fast-toml : npm i fast-toml
.
Then, let's suppose we have the following TOML file :
# myFile.toml
title = 'Hey universe'
[soundOptions]
volume = 68
soundName = 'Hey universe'
file = 'sounds/hey-universe.mp3'
We read the file and transform it into a javascript object this way :
const TOML = require('fast-toml')
const fs = require('fs')
const tomlString = String(fs.readFileSync('myFile.toml'))
const data = TOML.parse(tomlString)
console.log(data.title) // 'Hey universe'
console.log(data.soundOptions.volume) // 68
If you want to read from a file, you can directly use the TOML.parseFile
or TOML.parseFileSync
functions :
const TOML = require('fast-toml')
// async / await (any error will be thrown)
const data = await TOML.parseFile('myFile.toml')
console.log(data)
// sync (any error will be thrown)
const data = TOML.parseFileSync('myFile.toml')
console.log(data)
// promise (we catch errors in a callback)
TOML.parseFile('myFile.toml')
.then(data => console.log(data))
.catch(err => console.error(err))
You also can use the parser with Javascript template strings :
const TOML = require('fast-toml')
const data = TOML `
title = 'Hey universe'
[soundOptions]
volume = 68
soundName = 'Hey universe'
file = 'sounds/hey-universe.mp3'
`
console.log(data.title) // 'Hey universe'
console.log(data.soundOptions.volume) // 68
You can download the browser version of fast-toml here.
Just add the file to your project and require it with a script tag. You can then use the globally defined TOML
object.
Here is the comparison between fast-toml and the other 0.5.0-compliant TOML parsers for Javascript :
(All time values are milliseconds)
fast-toml | Iarna's toml | j-toml | Bombadil | |
---|---|---|---|---|
Require | 2.375 | 14.720 | 5.969 | 196.741 |
First round | 9.489 | 13.911 | 12.267 | 69.970 |
One-use (require+first round) | 11.864 | 28.631 | 18.236 | 266.711 |
Warm round | 1.483 | 7.275 | 1.420 | 34.878 |
Hot round | 0.501 | 0.604 | 0.627 | 6.639 |
Package size | 13.8 ko | 93.1 ko | 261 ko | +3000 ko |
The comparison has been made in a Node 11.2.0 environment with this medium-size sample TOML file, which covers about all the different ways to use TOML.
The comparison has been made in three rounds because of the way Javascript works :
Bombadil is so big and slow compared to others parsers because it uses a third-party library (Chevrotain) - even though Chevrotain is describing itself as 'blazing fast' (as everyone does nowadays :p).
fast-toml
is also robust. Errors are prettily handled, giving you clear informations about bad syntaxes.
In actual NodeJs package ecosystem, your imported libraries can grow very fast in size. Because they import other libraries themselves, which also import their own libraries, etc... Furthermore, most libraries carry a lot of stuff you absolutely don't need.
The package size of fast-toml
is so small because it follows this principle :
fast-toml
is a bit more permissive than his brothers and sisters. Especially :
These small tweaks make the TOML language even more comfortable to read and write, but be aware they are not standard.
FAQs
Fast and light parser for TOML 0.5, an alternative to JSON or YAML file formats.
The npm package fast-toml receives a total of 220 weekly downloads. As such, fast-toml popularity was classified as not popular.
We found that fast-toml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.