Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
grunt-text-replace
Advanced tools
Replace text in files using strings, regexs or functions.
In your project's gruntfile directory, run:
npm install grunt-text-replace --save-dev
Then add this line to your project's gruntfile:
grunt.loadNpmTasks('grunt-text-replace');
replace: {
example: {
src: ['text/*.txt'], // source files array (supports minimatch)
dest: 'build/text/', // destination directory or file
replacements: [{
from: 'Red', // string replacement
to: 'Blue'
}, {
from: /(f|F)(o{2,100})/g, // regex replacement ('Fooo' to 'Mooo')
to: 'M$2'
}, {
from: 'Foo',
to: function (matchedWord) { // callback replacement
return matchedWord + ' Bar';
}
}]
}
}
Here's another example using grunt.template, and overwriting original source files:
replace: {
another_example: {
src: ['build/*.html'],
overwrite: true, // overwrite matched source files
replacements: [{
from: /[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{2,4}/g,
to: "<%= grunt.template.today('dd/mm/yyyy') %>"
}]
}
}
replace is the top level task that goes in your grunt.initConfig({})
. It is
a multi-task, meaning that it must contain targets, which you can
name anything you like.
src is an array of source files to be replaced, and is required. It supports minimatch paths.
dest is the destination for files to be replaced, and can refer to either a:
'path/output.txt'
'path/'
grunt-text-replace will throw an error if multiple source files are mapped to a single file.
overwrite should be used for in-place replacement, that is when all you need to do is overwrite existing files. To use it, omit dest, otherwise grunt-text-replace will throw an error. You can only use one or the other.
replacements is an array of from and to replacements. See the examples above.
from is the old text that you'd like replace. It can be a:
'Red'
matches all instances of 'Red' in file/Red/g
same as aboveto is the replacement. It can be a:
$1
, $2
, etcWhere to is a function, the function receives 4 parameters:
// Where the original source file text is: "Hello world"
replacements: [{
from: /wor(ld)/g,
to: function (matchedWord, index, fullText, regexMatches) {
// matchedWord: "world"
// index: 6
// fullText: "Hello world"
// regexMatches: ["ld"]
return 'planet'; //
}
}]
// The new text will now be: "Hello planet"
Where to is a JavaScript object, type coercion will apply as follows:
options is an object, specific to a target, and the only supported option is processTemplates
processTemplates when set to false (by default it is true) switches off grunt.template processing within function return statements. It doesn't work for string replacements (ie. when the replacement is a string, not a function), as grunt processes templates within config string values before they are passed to the plugin.
replace: {
prevent_templates_example: {
src: ['text/*.txt'],
dest: 'build/text/',
options: {
processTemplates: false
},
replacements: [{
from: /url\(.*\)/g,
to: function () {
return "url(<% Don't process this template, retain the delimeters %>)";
}
}]
}
}
Some changes I'm considering. Happy to receive suggestions for/against:
Patch releases will generally remain undocumented in this release history. I'll do so if there's enough reason for it, such as a functionality tweak, or significant bug fix. For more detail see the source.
Copyright (c) 2013 Jonathan Holmes Licensed under the MIT license.
FAQs
Replace text in files using strings, regexs or functions.
The npm package grunt-text-replace receives a total of 29,836 weekly downloads. As such, grunt-text-replace popularity was classified as popular.
We found that grunt-text-replace demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.