Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
JSON11 is an extension to the popular JSON and JSON5 file formats. With the right options, it can be used for machine-to-machine communication.
JSON11 extends the JSON5 Data Interchange Format which is itself a superset of JSON (so valid JSON and JSON5 files will always be valid JSON11 files), to include some productions from ECMAScript 11 (ES11). It's also a subset of ES11, so valid JSON11 files will always be valid ES11.*
The following ECMAScript 11 features, which are not supported in JSON or JSON5, have been extended to JSON11.
The following ECMAScript 5.1 features, which are not supported in JSON, have been inherited from JSON5.
Kitchen-sink example:
{
// comments
unquoted: 'and you can quote me on that',
singleQuotes: 'I can use "double quotes" here',
lineBreaks: "Look, Mom! \
No \\n's!",
hexadecimal: 0xdecaf,
leadingDecimalPoint: .8675309, andTrailing: 8675309.,
positiveSign: +1,
trailingComma: 'in objects', andIn: ['arrays',],
"backwardsCompatible": "with JSON",
"longNumeral": 1186694007922679455n
}
npm install json11
const JSON11 = require('json11')
import JSON11 from 'json11'
<!-- This will create a global `JSON11` variable. -->
<script src="https://unpkg.com/json11/dist/umd/index.min.js"></script>
<script type="module">
import JSON11 from 'https://unpkg.com/json11/dist/es/index.min.mjs'
</script>
The JSON11 API is compatible with the JSON API.
Parses a JSON11 string, constructing the JavaScript value or object described by the string. An optional reviver function can be provided to perform a transformation on the resulting object before it is returned.
JSON11.parse(text[, reviver, [options]])
text
: The string to parse as JSON11.reviver
: If a function, this prescribes how the value originally produced by
parsing is transformed, before being returned.options
: An object with the following properties:
withLongNumerals
: (false) To parse integers beyond safe limits as BigInt.The object corresponding to the given JSON11 text.
Converts a JavaScript value to a JSON11 string, optionally replacing values if a replacer function is specified, or optionally including only the specified properties if a replacer array is specified.
JSON11.stringify(value[, replacer[, space]])
JSON11.stringify(value[, options])
value
: The value to convert to a JSON11 string.replacer
: A function that alters the behavior of the stringification
process, or an array of String and Number objects that serve as a whitelist
for selecting/filtering the properties of the value object to be included in
the JSON11 string. If this value is null or not provided, all properties of the
object are included in the resulting JSON11 string.space
: A String or Number object that's used to insert white space into the
output JSON11 string for readability purposes. If this is a Number, it
indicates the number of space characters to use as white space; this number is
capped at 10 (if it is greater, the value is just 10). Values less than 1
indicate that no space should be used. If this is a String, the string (or the
first 10 characters of the string, if it's longer than that) is used as white
space. If this parameter is not provided (or is null), no white space is used.
If white space is used, trailing commas will be used in objects and arrays.options
: An object with the following properties:
replacer
: Same as the replacer
parameter.space
: Same as the space
parameter.quote
: A String representing the quote character to use when serializing
strings.quoteNames
: (false) Force wrapping property names in quotes.withBigInt
: (true) Serialize BigInt values with the 'n' suffixA JSON11 string representing the value.
Since JSON is more widely used than JSON11, this package includes a CLI for converting JSON11 to JSON and for validating the syntax of JSON11 documents.
npm install --global json11
json5 [options] <file>
If <file>
is not provided, then STDIN is used.
-s
, --space
: The number of spaces to indent or t
for tabs-o
, --out-file [file]
: Output to the specified file, otherwise STDOUT-v
, --validate
: Validate JSON11 but do not output JSON-V
, --version
: Output the version number-h
, --help
: Output usage informationFork this repo and clone your fork. Install the dependencies with npm i
.
When contributing code, please write relevant tests and run npm test
and npm run lint
before submitting pull requests. Please use an editor that supports
EditorConfig.
To report bugs or request features regarding this JavaScript implementation of JSON11, please submit an issue to this repository.
To report a security vulnerability, please follow the guidelines described in our security policy.
While JSON11 aims to be fully compatible with ES5, there is one exception where both JSON and JSON11 are not. Both JSON and JSON11 allow unescaped line and paragraph separator characters (U+2028 and U+2029) in strings, however ES5 does not. A proposal to allow these characters in strings was adopted into ES2019, making JSON and JSON11 fully compatible with ES2019.
MIT. See LICENSE.md for details.
JSON5 contributors did the heavy lifting.
FAQs
JSON for humans and machines
The npm package json11 receives a total of 190,222 weekly downloads. As such, json11 popularity was classified as popular.
We found that json11 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.