Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
json-stable-stringify-without-jsonify
Advanced tools
deterministic JSON.stringify() with custom sorting to get deterministic hashes from stringified results, with no public domain dependencies
The json-stable-stringify-without-jsonify package is used for producing deterministic JSON strings from JavaScript objects. This means that it generates a JSON output where the order of object keys is consistent across different runs, even if the order of keys in the input object changes. This is particularly useful in scenarios where JSON string output needs to be predictable, such as in caching mechanisms or in generating cryptographic hashes from JSON data.
Deterministic JSON Stringification
Converts an object into a JSON string with keys sorted in a stable order. This ensures that the JSON string output is the same regardless of how the object's properties are ordered.
{"a": 1, "b": 2}
Custom Comparator
Allows for custom sorting of the object keys by providing a comparator function. This can be used to control the order of keys in the resulting JSON string beyond the default lexicographical order.
{"opts": { "cmp": "(a, b) => a.key < b.key ? 1 : -1" }}
Cyclic Object Handling
Provides an option to handle cyclic references within objects. When set to true, it replaces cyclic references with a special string, allowing for the stringification of objects that would otherwise cause an error due to circular references.
{"opts": { "cycles": true }}
Similar in functionality to json-stable-stringify-without-jsonify, offering deterministic JSON stringification with options for custom key ordering and cyclic object handling. The main difference is that json-stable-stringify may include additional dependencies or functionalities not present in the 'without-jsonify' version.
This package also provides deterministic JSON stringification with a focus on performance. It aims to be faster than other similar packages by optimizing the stringification process, though it might not offer the same level of customization for key ordering or handling cyclic objects.
This is the same as https://github.com/substack/json-stable-stringify but it doesn't depend on libraries without licenses (jsonify).
deterministic version of JSON.stringify()
so you can get a consistent hash
from stringified results
You can also pass in a custom comparison function.
var stringify = require('json-stable-stringify');
var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
console.log(stringify(obj));
output:
{"a":3,"b":[{"x":4,"y":5,"z":6},7],"c":8}
var stringify = require('json-stable-stringify')
Return a deterministic stringified string str
from the object obj
.
If opts
is given, you can supply an opts.cmp
to have a custom comparison
function for object keys. Your function opts.cmp
is called with these
parameters:
opts.cmp({ key: akey, value: avalue }, { key: bkey, value: bvalue })
For example, to sort on the object key names in reverse order you could write:
var stringify = require('json-stable-stringify');
var obj = { c: 8, b: [{z:6,y:5,x:4},7], a: 3 };
var s = stringify(obj, function (a, b) {
return a.key < b.key ? 1 : -1;
});
console.log(s);
which results in the output string:
{"c":8,"b":[{"z":6,"y":5,"x":4},7],"a":3}
Or if you wanted to sort on the object values in reverse order, you could write:
var stringify = require('json-stable-stringify');
var obj = { d: 6, c: 5, b: [{z:3,y:2,x:1},9], a: 10 };
var s = stringify(obj, function (a, b) {
return a.value < b.value ? 1 : -1;
});
console.log(s);
which outputs:
{"d":6,"c":5,"b":[{"z":3,"y":2,"x":1},9],"a":10}
If you specify opts.space
, it will indent the output for pretty-printing.
Valid values are strings (e.g. {space: \t}
) or a number of spaces
({space: 3}
).
For example:
var obj = { b: 1, a: { foo: 'bar', and: [1, 2, 3] } };
var s = stringify(obj, { space: ' ' });
console.log(s);
which outputs:
{
"a": {
"and": [
1,
2,
3
],
"foo": "bar"
},
"b": 1
}
The replacer parameter is a function opts.replacer(key, value)
that behaves
the same as the replacer
from the core JSON object.
With npm do:
npm install json-stable-stringify
MIT
FAQs
deterministic JSON.stringify() with custom sorting to get deterministic hashes from stringified results, with no public domain dependencies
The npm package json-stable-stringify-without-jsonify receives a total of 29,529,428 weekly downloads. As such, json-stable-stringify-without-jsonify popularity was classified as popular.
We found that json-stable-stringify-without-jsonify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.