
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
json-selector-lang
Advanced tools
JSON Selector Language, or JSL, can be used to dynamically select JSON values. It is meant for use in client-side environments like the browser where bandwidth and performance constraints exist.
It was inspired by projects like jq and JMESPath, but is tiny by design— it only has two expressions.
As an example, if your data looks like the following:
const json = {
data: {
Data: {
items: [1, 3, 5, 7],
},
},
};
Select the Data object:
import { jsl } from 'json-selector-lang';
try {
const sel = jsl.compile('.data.Data');
const val = jsl.evaluate(json, sel);
// val = { items: [1, 3, 5, 7] }
} catch (e) {
// catch the parser errors
}
Select the items array:
import { jsl } from 'json-selector-lang';
try {
const sel = jsl.compile('.data.Data.items');
const val = jsl.evaluate(json, sel);
// val = [1, 3, 5, 7]
} catch (e) {
// catch the parser errors
}
Select the third entry in the items array:
import { jsl } from 'json-selector-lang';
try {
const sel = jsl.compile('.data.Data.items[2]');
const val = jsl.evaluate(json, sel);
// val = 5
} catch (e) {
// catch the parser errors
}
The main constraint in v1 is that it can only evaluate JSON where the outermost
type is object.
// can evaluate
{ data: [0,1,2] }
// cannot evaluate
[ {data: 0} ]
// cannot evaluate
42
// cannot evaluate
"data"
// cannot evaluate
null
💡 Compile your selectors once and reuse as much as possible.
FAQs
A tiny language for selecting JSON values
The npm package json-selector-lang receives a total of 50 weekly downloads. As such, json-selector-lang popularity was classified as not popular.
We found that json-selector-lang demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.