
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A JSON mapping utility to help generate meta data of a JSON object. Maps depth and paths to found keys.
Generated paths are compatible with Lodash's _.get and _.set to help manipulate deep data sets.
The generated data is in an accessible Map object which you can run generator functions over as necessary or use the built in keys() and paths() to retrieve information in a more familiar way.
npm install jmeta or yarn add jmeta
const JMeta = require('jmeta')
const _ = require('lodash')
const data = {
a: {
b: {
c: [
[ { d: true }, 'ignored', { a: 'duplicate' } ]
]
}
}
}
const jmeta = new JMeta(data)
console.log(jmeta.paths()) // Outputs: [ 'a', 'a.b.c[0][2].a', 'a.b', 'a.b.c', 'a.b.c[0][0].d' ]
console.log(jmeta.keys()) // Outputs: [ 'a', 'b', 'c', 'd' ] NOTE: Unique keys
console.log(jmeta.size) // Outputs: 5 (NOTE: Accounts for duplicate found keys)
console.log(jmeta.duplicates) // Outputs: [ 'a' ]
let foo = _.get(data, jmeta.paths()[1]) // 'a.b.c[0][2].a'
console.log(foo) // Outputs: 'duplicate'
// Access the map object directly
console.log(jmeta.map.get('a')) // Outputs: [ { depth: 1, path: 'a' }, { depth: 6, path: 'a.b.c[0][2].a' } ]
// You also have the option to get only the "leaves" of the tree. This will return all the final paths and not their connecting branches to them.
const jmeta = new JMeta(data, { finalPathsOnly: true })
console.log(jmeta.paths()) // Outputs [ 'a.b.c[0][0].d', 'a.b.c[0][2].a' ]
Takes an options object as its only parameter to specify some basic filtering.
The options object supports the following filters:
{ depth: <number>, includes: <string>, key: <string> }.
Filtering options can be combined in any way to reduce results accordingly.
NOTE: Paths() will always return an array, on no results found the return will simply be an empty array [].
const JMeta = require('jmeta')
const _ = require('lodash')
const data = {
location: {
france: [ { name: 'Tom' }, { name: 'Mary' } ],
italy: [ { name: 'Mike' } ]
}
}
const jmeta = new JMeta(data)
// DEPTH FILTERING
console.log(jmeta.paths({ depth: 2 })) // Outputs: ['location.france', 'location.italy']
console.log(jmeta.paths({ depth: 4 })) // Outputs: ['location.france[0].name', 'location.france[1].name', 'location.italy[0].name']
// PATH INCLUDES FILTERING
console.log(jmeta.paths({ includes: 'france' })) // Outputs: ['location.france', 'location.france[0].name', 'location.france[1].name']
console.log(jmeta.paths({ includes: 'france[0]' })) // Outputs: ['location.france[0].name']
// KEY FILTERING
console.log(jmeta.paths({ key: 'france' })) // Outputs: ['location.france']
console.log(jmeta.paths({ key: 'name' }) // Outputs: ['location.france[0].name', 'location.france[1].name', 'location.italy[0].name']
Takes an options object as its only parameter to specify some basic filtering The options object supports the following filters:
{ depth: <number> }.
const JMeta = require('jmeta')
const _ = require('lodash')
const data = {
location: {
france: [ { person: 'Tom' }, { person: 'Mary' } ],
italy: [ { person: 'Mike' } ]
}
}
const jmeta = new JMeta(data)
console.log(jmeta.keys()) // Outputs: [ 'location', 'france', 'person', 'italy' ] NOTE: Returns unique found keys only
console.log(jmeta.keys({ depth: 2 })) // Outputs: [ 'france', 'italy' ]
console.log(jmeta.keys({ depth: 4 })) // Outputs: [ 'person' ]
FAQs
JSON metadata generator, outputs lodash compatible get/set strings
We found that jmeta demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.