
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
jgeXml provides an event-driven parser to process XML 1.0 / 1.1. Both pull and push modes are supported. Tools are included for writing XML (documents or fragments) and to convert between XML and JSON.
The code has no dependencies on other modules or native libraries.
Setting up a push-parser is as simple as:
const jgexml = require('jgexml');
const result = jgexml.parse(xml, function(state, token) {
//...
});
sDeclarationsDocTypesDTDsElementsAttributesValuesEndElementsContentsCommentsProcessingInstructionsCDatasErrorsEndDocumentNo event is generated for ignoreable whitespace, unlike SAX. Empty elements are normalised into sElement/sEndElement pairs.
jgeXml is a non-validating parser. It attempts to report if the XML is well-formed or not.
Both when reading and writing, attributes follow after the element event, and in the order they are given in the source.
When converting to JSON, the attributePrefix (to avoid name clashes with child elements) is configurable per parse.
In JSON, child elements can be represented as properties (the default) or objects (exposing the parser's intermediary state).
The parser by default treats all content as strings when converting to JSON, optionally data can be coerced to primitive numbers or null values.
The xsd2json utility can convert most simple XML Schemas to JSON schema draft 4. XSD's may of course be converted to JSON simply as if they were XML documents too.
Experimental JSONPath and JSONT utilities are under development.
jgeXml is currently schema agnostic and staunchly atheist when it comes to DTDs. It can parse XML documents with schema information, but it is up to the
consumer to interpret the namespace portions of element names. It can parse internal DTDs, but does nothing with them.
xmlWrite minimally supports DTDs but you must build them and the DOCTYPE yourself.
The parser is string-based; to process streams, read the data into a string first. It may be memory intensive on large documents.
xml2json - convert XML to JSON.json2xml - convert JSON to XML.xsd2json - convert XSD to JSON Schema.See in the examples directory: xml2xml.js for parsing XML to XML, fragment.js for writing XML fragments, jpath.js for JSONPath examples, jsont.js for JSONT examples and pullparser.js / pushparser.js for how to set up and run the parser.
FAQs
The Just-Good-Enough XML Toolkit
The npm package jgexml receives a total of 62,712 weekly downloads. As such, jgexml popularity was classified as popular.
We found that jgexml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.