Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
gunzip-maybe
Advanced tools
Transform stream that gunzips its input if it is gzipped and just echoes it if not
The 'gunzip-maybe' npm package is a utility for conditionally decompressing gzip files. It is particularly useful in streams where you may not know if the input is gzipped or not. The package will automatically detect and decompress gzipped input, passing through non-gzipped input unchanged.
Conditional Decompression
This feature allows you to conditionally decompress a file if it is gzipped. The code sample reads a potentially gzipped file ('file.txt.gz') and writes the decompressed content to 'file.txt'. If the input file is not gzipped, it simply passes the content through unchanged.
const fs = require('fs');
const gunzipMaybe = require('gunzip-maybe');
fs.createReadStream('file.txt.gz')
.pipe(gunzipMaybe())
.pipe(fs.createWriteStream('file.txt'));
Stream Processing
This feature demonstrates how 'gunzip-maybe' can be used in a stream processing pipeline. The code sets up a PassThrough stream, pipes it through 'gunzip-maybe', and then pipes the result to another PassThrough stream. This allows for flexible stream processing where the input may or may not be gzipped.
const { PassThrough } = require('stream');
const gunzipMaybe = require('gunzip-maybe');
const input = new PassThrough();
const output = new PassThrough();
input.pipe(gunzipMaybe()).pipe(output);
input.write('some data');
input.end();
output.on('data', (data) => {
console.log(data.toString());
});
The 'zlib' package is a core Node.js module that provides compression and decompression functionalities, including gzip. Unlike 'gunzip-maybe', 'zlib' does not automatically detect if the input is gzipped, so you need to handle that logic yourself.
The 'decompress' package is a comprehensive decompression library that supports multiple formats including gzip, tar, and zip. It is more versatile than 'gunzip-maybe' but also more complex to use if you only need conditional gzip decompression.
The 'node-unzipper' package is focused on unzipping files, including gzip. It provides more control over the decompression process compared to 'gunzip-maybe', but requires more setup and configuration.
Transform stream that gunzips its input if it is gzipped and just echoes it if not.
npm install gunzip-maybe
Simply pipe a gzipped (or not gzipped) stream to gunzip([maxRecursion = 3])
and read the unzipped content.
maxRecursion
protects the unzip mechanism from an infinite recursion in case of a malicious archive.
// this will gunzip gzippedStream
gzippedStream.pipe(gunzip()).pipe(process.stdout);
// this will just echo plainTextStream
plainTextStream.pipe(gunzip()).pipe(process.stdout);
npm install -g gunzip-maybe
gunzip-maybe --help # will print out usage
MIT
FAQs
Transform stream that gunzips its input if it is gzipped and just echoes it if not
The npm package gunzip-maybe receives a total of 1,944,175 weekly downloads. As such, gunzip-maybe popularity was classified as popular.
We found that gunzip-maybe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.