Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The full-icu npm package provides full ICU (International Components for Unicode) data for Node.js, enabling comprehensive internationalization support. This includes features like date and time formatting, number formatting, and collation, which are essential for applications that need to support multiple languages and locales.
Date and Time Formatting
This feature allows you to format dates and times according to different locales. In this example, the date is formatted in French (France) locale.
const { DateTimeFormat } = require('intl');
const dtf = new DateTimeFormat('fr-FR', { year: 'numeric', month: 'long', day: 'numeric' });
console.log(dtf.format(new Date()));
Number Formatting
This feature enables number formatting according to different locales. The example shows how to format a number as a currency in German (Germany) locale.
const { NumberFormat } = require('intl');
const nf = new NumberFormat('de-DE', { style: 'currency', currency: 'EUR' });
console.log(nf.format(123456.789));
Collation
Collation allows for locale-aware string comparison and sorting. The example demonstrates sorting an array of strings in Spanish (Spain) locale.
const { Collator } = require('intl');
const collator = new Collator('es-ES');
const sorted = ['z', 'a', 'ä'].sort(collator.compare);
console.log(sorted);
Globalize is a comprehensive internationalization library that provides similar functionalities to full-icu, such as date and time formatting, number formatting, and message formatting. It is built on top of the Unicode CLDR data and provides a rich set of features for handling various internationalization needs.
i18next is a popular internationalization framework for JavaScript that focuses on providing a complete solution for translating applications. While it does not provide low-level ICU functionalities like full-icu, it excels in managing translations and localization workflows, making it a good complement to full-icu for applications that need both translation management and ICU features.
Moment.js is a widely-used library for parsing, validating, manipulating, and formatting dates. While it does not provide the full range of ICU functionalities, it offers extensive support for date and time operations, including localization features. It is often used in conjunction with other libraries to provide comprehensive internationalization support.
Install full ICU (Internationalization) data from GitHub or npm for Node.js.
Importing this package does not have any useful effect, see below.
Originally, Node.js did not come with information for all of the world’s languages. The default build mode was “small-icu” which means English-only, saving about 50% of the total Node.js download footprint.
Since Node.js 13, full ICU data has been the default for Node.js. So this module is only helpful for older Node.js versions, or custom builds which specify small-icu.
This module does not add any internationalization capabilities to Node.js, but it can provide a convenient way of loading the data.
Please see “providing ICU data at runtime” in the Node.js docs for more information.
small-icu
?Let's find out:
$ node -p 'process.config.variables.icu_small'
true
If you see false
here, you aren't using small ICU and this package won’t do
anything useful for you, although it is harmless.
First, you must have a Node.js that is configured for small-icu
.
See above.
npm install full-icu
Note: Set env var FULL_ICU_PREFER_NPM=true
to prefer using the icu4c-data
npm module,
otherwise the default is now to load from ICU4C’s GitHub release.
npm install -g full-icu
Instructions will be printed out on how to activate this data for your version of node.
This work gets done in a postinstall
script which copies the icudt*.dat
file up to this module's level.
Note that this is only packaging and build metadata. For Internationalization API, see Intl.
require('full-icu')
returns a few properties:
nodever
- the full Node version (ex: 14.2.0
)
node_maj
- the major part of the node version (ex: 14
)
node_min
- the minor part of the node version (ex 2
)
icu_small
- if truthy, means that node was built with
small-icu (English only). If falsy, means that the full-icu
package is not relevant.
icuver
- the full ICU version, if available, such as 55.1. Sometimes only the major version is available.
icumaj
- ICU major ver, such as 55
. May be === icuver
.
icumin
- ICU minor version, such as 1
if available.
icuend
- ICU endianness - little, big or ebcdic.
icupkg
- the npm
package needed to get full ICU data, if any.
icudat
- the raw data file ICU expects to find for full data, if any.
noi18n
- if truthy, no ICU / Intl build was enabled for your node version. Sorry.
oldNode
- The node version is older than this package can really think about.
node-full-icu-path
will print the full icudt*.dat
path, if available.
Please see our CONTRIBUTING
guide if you'd like to help with this initiative!
This repository is subject to the terms under the Node.js license. Some usage of this data is governed by the Unicode Terms of Use, which is included in the unicode-license.txt
Copyright © 1991-2021 Unicode, Inc. and Node.js contributors. All rights reserved.
FAQs
install 'full-icu' data for your current node
We found that full-icu demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.