Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
HONEY is the human-friendly object notation that easily converts to JSON.
Here's an example of what it looks like:
// WARNING: The syntax is still evolving and awaiting a solid round of
// constructive feedback and criticism. Do not use in production until
// a 1.0 release is reached.
name
HONEY
version
0.1.0
description
HONEY is the human-friendly object notation that easily converts to JSON.
It's a simple line-based, whitespace-sensitive file format, designed to
play well with humans.
tags
- stringify
- parse
- honey
- json
- javascript
HONEY is a blend of JSON's simplicity and markdown's legibility, designed to play well with version control systems and not scare off humans.
// lists of lists (yup, comments are supported)
-
- one
- two
-
- three
- four
// list of objects
-
id
1
name
One
-
id
2
name
Two
// empty values
empty list
[]
empty object
{}
empty string
""
null value
null
This repo includes a reference implementation written in es6.
You are free to copy, modify, and redistribute it at will. For convenience
the package is available as hny
on NPM. It will be updated as the
spec evolves.
import HONEY from "hny";
HONEY.parse(string)
HONEY.stringify(value)
HONEY files should use .hny
or .honey
. The shorter form is preferred.
HONEY strictly requires soft two-space indentation.
// right
name
HONEY
// wrong
name
HONEY
// wrong
name
\tHONEY
HONEY supports single-line comments, javascript style. Inline and multi-line comments are not supported.
// this is
// a comment
name
HONEY // this is NOT a comment
HONEY supports the same types as JSON:
You can wrap any value in double quotes to skip the implicit typecasting:
// this will be a number
version
1.0
// this will be a string
version
"1.0"
Multi-line strings should work just fine in most cases without any special handling. However, if you have text that looks similar to HONEY's object notation you'll need to use the heredoc form:
description
This is a multi-line string.
It doesn't require anything fancy.
// if in doubt, use a heredoc
description
"""
- one
- two
- three
"""
Leading whitespace is automatically trimmed up to the natural indentation.
JSON's simple structure is great but the syntax is a little too technical for humans. Being scolded for forgetting a comma (or adding a trailing one) is something only developers put up with. It's also really awful for multi-line strings (such as markdown fields) and doesn't allow comments.
YAML is potentially dangerous, mostly because it tries to do too much. And the syntax is still a little too technical.
CSON is getting closer, but doesn't permit special characters in object keys unless you quote them and still requires colons for each key. The markdown approach to lists is much more intuitive than brackets, quotes, and commas for each value. It's nice to be able to omit the commas, but for long lists the arrays-without-commas syntax quickly stops looking like a list.
TOML claims to be obvious and minimal, but that's only the case if you're a developer. Overall it still feels like you're writing code, which is fine since it was designed for config files, not general data. Still too technical for humans.
git clone git@github.com:honey/honey.git
cd honey
npm install -g babel
npm install
npm test
Got a proposal for simplifying HONEY's syntax even further? Great! Open an issue or submit a pull request.
I'd still love to see a more natural way to handle empty lists and objects.
FAQs
HONEY, the human-friendly object notation
The npm package hny receives a total of 0 weekly downloads. As such, hny popularity was classified as not popular.
We found that hny demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.