Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
By Philipp Burckhardt - Nov 14, 2025
hast-util-to-dom
Advanced tools
hast-util-to-dom
hast utility to transform to a DOM tree.
Contents
- What is this?
- When should I use this?
- Install
- Use
- API
- Syntax tree
- Types
- Compatibility
- Security
- Related
- Contribute
- License
What is this?
This package is a utility that creates a DOM tree
(defaulting to the actual DOM but also supporting things like
jsdom)
from a hast (HTML) syntax tree.
When should I use this?
You can use this project when you want to turn hast into a DOM in browsers,
either to use it directly on a page,
or to enable the use of DOM APIs
(such as querySelector to find things or innerHTML to serialize stuff).
The hast utility hast-util-from-dom does the
inverse of this utility.
It turns DOM trees into hast.
The rehype plugin rehype-dom-stringify wraps
this utility to serialize as HTML with DOM APIs.
Install
This package is ESM only. In Node.js (version 16+), install with npm:
npm install hast-util-to-dom
In Deno with esm.sh:
import {toDom} from 'https://esm.sh/hast-util-to-dom@4'
In browsers with esm.sh:
<script type="module">
import {toDom} from 'https://esm.sh/hast-util-to-dom@4?bundle'
</script>
Use
Say our page example.html looks as follows:
<!doctype html>
<title>Example</title>
<body>
<script type="module">
import {h} from 'https://esm.sh/hastscript?bundle'
import {toDom} from 'https://esm.sh/hast-util-to-dom?bundle'
const tree = h('main', [
h('h1', 'Hi'),
h('p', [h('em', 'Hello'), ', world!'])
])
document.body.append(toDom(tree))
</script>
Now running open example.html shows the
main,
h1,
and p elements on the page.
API
This package exports the identifier toDom.
There is no default export.
toDom(tree[, options])
Turn a hast tree into a DOM tree.
Parameters
Returns
DOM node (DomNode).
AfterTransform
Callback called when each node is transformed (TypeScript type).
Parameters
Returns
Nothing.
Options
Configuration (TypeScript type).
Fields
afterTransform(AfterTransform, optional) — callback called when each node is transformeddocument(Document, default:globalThis.document) — document interface to use.fragment(boolean, default:false) — whether to return a DOM fragment (true) or a whole document (false)namespace(string, default: depends) — namespace to use to create elements
Syntax tree
The syntax tree is hast.
Types
This package is fully typed with TypeScript.
It exports the additional types AfterTransform and
Options.
Compatibility
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release,
we drop support for unmaintained versions of Node.
This means we try to keep the current release line,
hast-util-to-dom@4,
compatible with Node.js 16.
Security
Use of hast-util-to-dom can open you up to a
cross-site scripting (XSS) attack if the hast tree is unsafe.
Use hast-util-santize to make the hast tree
safe.
Related
hast-util-sanitize— sanitize hast nodeshast-util-to-html— serialize as HTMLhast-util-from-dom— create a hast tree from a DOM tree
Contribute
See contributing.md
in
syntax-tree/.github
for ways to get started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
License
FAQs
hast utility to transform to the DOM
We found that hast-util-to-dom demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Package last updated on 19 Feb 2025
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Security News
PyPI Expands Trusted Publishing to GitLab Self-Managed as Adoption Passes 25 Percent
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads
By Sarah Gooding - Nov 14, 2025
Research
/Security News
Malicious Chrome Extension Exfiltrates Seed Phrases, Enabling Wallet Takeover
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.
By Kirill Boychenko - Nov 12, 2025