
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
json-schema-ref-parser-kill-circular
Advanced tools
Parse, Resolve, and Dereference JSON Schema $ref pointers
You've got a JSON Schema with $ref pointers to other files and/or URLs. Maybe you know all the referenced files ahead of time. Maybe you don't. Maybe some are local files, and others are remote URLs. Maybe they are a mix of JSON and YAML format. Maybe some of the files contain cross-references to each other.
{
"definitions": {
"person": {
// references an external file
"$ref": "schemas/people/Bruce-Wayne.json"
},
"place": {
// references a sub-schema in an external file
"$ref": "schemas/places.yaml#/definitions/Gotham-City"
},
"thing": {
// references a URL
"$ref": "http://wayne-enterprises.com/things/batmobile"
},
"color": {
// references a value in an external file via an internal reference
"$ref": "#/definitions/thing/properties/colors/black-as-the-night"
}
}
}
JSON Schema $Ref Parser is a full JSON Reference and JSON Pointer implementation that crawls even the most complex JSON Schemas and gives you simple, straightforward JavaScript objects.
$ref pointers to external files and URLs, as well as custom sources such as databases$ref pointers$ref pointers to the same value always resolve to the same object instance$RefParser.dereference(mySchema, function(err, schema) {
if (err) {
console.error(err);
}
else {
// `schema` is just a normal JavaScript object that contains your entire JSON Schema,
// including referenced files, combined into a single object
console.log(schema.definitions.person.properties.firstName);
}
});
Or use Promises syntax instead. The following example is the same as above:
$RefParser.dereference(mySchema)
.then(function(schema) {
console.log(schema.definitions.person.properties.firstName);
})
.catch(function(err) {
console.error(err);
});
For more detailed examples, please see the API Documentation
Install using npm:
npm install json-schema-ref-parser
Then require it in your code:
var $RefParser = require('json-schema-ref-parser');
Reference ref-parser.js or ref-parser.min.js in your HTML:
<script src="https://unpkg.com/json-schema-ref-parser/dist/ref-parser.min.js"></script>
<script>
$RefParser.dereference(mySchema)
.then(function(schema) {
console.log(schema.definitions.person.properties.firstName);
})
.catch(function(err) {
console.error(err);
});
</script>
Full API documentation is available right here
I welcome any contributions, enhancements, and bug-fixes. File an issue on GitHub and submit a pull request.
To build/test the project locally on your computer:
Clone this repo
git clone https://github.com/APIDevTools/json-schema-ref-parser.git
Install dependencies
npm install
Run the build script
npm run build
Run the tests
npm test
Start the local web server
npm start (then browse to http://localhost:8080/test/)
JSON Schema $Ref Parser is 100% free and open-source, under the MIT license. Use it however you want.
Thanks to these awesome companies for their support of Open Source developers ❤
FAQs
Parse, Resolve, and Dereference JSON Schema $ref pointers
The npm package json-schema-ref-parser-kill-circular receives a total of 1 weekly downloads. As such, json-schema-ref-parser-kill-circular popularity was classified as not popular.
We found that json-schema-ref-parser-kill-circular demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.