Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
json-file-plus
Advanced tools
Read from and write to a JSON file, minimizing diffs and preserving formatting.
A module to read from and write to JSON files, without losing formatting, to minimize diffs.
var jsonFile = require('json-file-plus');
var path = require('path'); // in node-core
var filename = path.join(process.cwd(), 'package.json');
var callback = function (err, result) { /* your code here */ };
/* Note: jsonFile also returns a Promise, if you prefer that to a Node-style callback ("errorback"). */
jsonFile(filename, function (err, file) {
if (err) { return doSomethingWithError(err); }
file.data; // Direct access to the data from the file
file.format; // extracted formatting data. change at will.
file.get('version'); // get top-level keys. returns a Promise
file.get('version', callback); // get top-level keys. calls the errorback
file.get(); // get entire data. returns a Promise
file.get(callback); // get entire data. calls the errorback
/* pass any plain object into "set" to merge in a deep copy */
/* please note: references will be broken. */
/* if a non-plain object is passed, will throw a TypeError. */
file.set({
foo: 'bar',
bar: {
baz: true
}
});
file.remove('description'); // remove a specific key-value pair. returns a Promise
file.remove('description', callback); // remove a specific key-value pair. calls the errorback
/* change the filename if desired */
file.filename = path.join(process.cwd(), 'new-package.json');
/* Save the file, preserving formatting. */
/* Errorback will be passed to fs.writeFile */
/* Returns a Promise. */
file.save(callback).then(function () {
console.log('success!');
}).catch(function (err) {
console.log('error!', err);
});
});
Simply run npm test
in the repo
FAQs
Read from and write to a JSON file, minimizing diffs and preserving formatting.
We found that json-file-plus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.