
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
hast-util-to-string
Advanced tools
The hast-util-to-string package is a utility for converting HAST (Hypertext Abstract Syntax Tree) nodes to plain strings. This is particularly useful when working with virtual DOM representations in projects that involve transforming HTML or Markdown content.
Convert HAST node to string
This feature allows the conversion of a HAST node, which can be a complex structure with nested elements, into a plain string. The code sample demonstrates creating a simple HAST tree using hastscript and then converting it to a string using hast-util-to-string.
const toString = require('hast-util-to-string');
const h = require('hastscript');
const tree = h('div', [h('p', 'Hello, world!')]);
const result = toString(tree);
console.log(result); // Outputs: 'Hello, world!'
Part of the unified.js ecosystem, rehype-stringify converts HAST trees to HTML strings. It is similar to hast-util-to-string but focuses on generating HTML output rather than plain text, making it suitable for different use cases where HTML structure needs to be preserved.
This package converts HAST nodes to MDAST (Markdown Abstract Syntax Tree) nodes. While hast-util-to-string focuses on converting to plain text, hast-util-to-mdast is useful for transformations into Markdown, maintaining markdown-specific formatting and structures.
hast
utility to get the plain-text value of a node.
This package is a utility to get the plain-text value of a node.
You can use this package when you want to get the plain text value of a node.
The algorithm used by this package is like the DOMs Node#textContent
getter.
To use the DOMs Node#innerText
algorithm instead, use
hast-util-to-text
.
innerText
is aware of how things are displayed, for example turning hard
breaks (<br>
) into line endings.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install hast-util-to-string
In Deno with esm.sh
:
import {toString} from 'https://esm.sh/hast-util-to-string@3'
In browsers with esm.sh
:
<script type="module">
import {toString} from 'https://esm.sh/hast-util-to-string@3?bundle'
</script>
import {h} from 'hastscript'
import {toString} from 'hast-util-to-string'
toString(h('p', 'Alpha'))
//=> 'Alpha'
toString(h('div', [h('b', 'Bold'), ' and ', h('i', 'italic'), '.']))
//=> 'Bold and italic.'
This package exports the identifier
toString
.
There is no default export.
toString(node)
Get the plain-text value of a node.
node
(Node
) — node to serializeSerialized node (string
).
HTML is parsed according to WHATWG HTML (the living standard), which is also followed by all browsers.
The syntax tree used is hast.
This package is fully typed with TypeScript.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line,
hast-util-to-string@^3
,
compatible with Node.js 16.
As rehype works on HTML and improper use of HTML can open you up to a
cross-site scripting (XSS) attack, use of rehype can also be unsafe.
Use rehype-sanitize
to make the tree safe.
See contributing.md
in rehypejs/.github
for ways
to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
hast utility to get the plain-text value of a node
The npm package hast-util-to-string receives a total of 1,709,639 weekly downloads. As such, hast-util-to-string popularity was classified as popular.
We found that hast-util-to-string demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.