
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
Dependencyless JS library that converts a generic JSON-like object to a map-like, key-value object.
Dependencyless JS library that converts a generic JSON-like object to a map-like, key-value object.
json2kv is a library that converts a generic JSON to a map-like, key-value object. All it needs is a JSON-ish datum (that is, either a real JSON file or a JS serializable Object), and a property name. User defined exceptions are supported too. At the moment, only a property from the immediate children is supported.
It is fully tested, with 100% coverage.
With yarn:
yarn add json2kvOr, with npm:
npm i -S json2kvThe foundations of this library have been laid on StackOverflow, after I've managed to provide [a meaningful answer](map given the 'value' property of all the nested objects) to this problem: create a key-value object given a JSON and a certain property, which is common among some of the nested objects. In other words, the problem this package solves is converting a JSON to a map structure (key-value object), filtering out the unnecessary props. Hence the name json2kv.
// import the library
import json2kv from 'json2kv';
// define the JSON-like data
const data = {
some: 'string',
someObjWithoutValueProp: {
yep: 'nope'
},
battery: {
value: 4.08,
metadata: {
// ...
}
},
location: {
value: {
coordinates: 'Some location value'
}
},
temperature: {
value: 32.5,
metadata: {
// ...
}
}
};
const prop = 'value';
const result = json2kv(data, prop);
console.log(result);
/*
{
battery: 4.08, // value of data.battery.value
location: { // value of data.location.value
coordinates: 'Some location value',
},
temperature: 32.5, // value of data.temperature.value
}
*/
You can also define custom exceptions to override the behaviour for specific properties.
To do you you need to define a Map<string, string>, having a child property of data as key
(in this case, location, as in data.location), and the object path of the desired
mapping as value (in this case, value.coordinates, as in data.location.value.coordinates).
const exceptions = new Map(); // Map<string, string>
exceptions.set('location', 'value.coordinates');
const resultWithExceptions = json2kv(data, prop, exceptions);
console.log(resultWithExceptions);
/*
{
battery: 4.08, // value of data.battery.value
location: 'Some location value', // value of data.location.value.coordinates
temperature: 32.5 // value of data.temperature.value
}
*/
As always, contributions are always welcome, and remember:
flowchecks if Flow definitions are written properly
lintchecks if code conforms to linting rules (eslint)
lint - will check js
lint --fix - will automatically fix js
publishRuns all the linting/test suites Creates a brand new build Pushes a release to npm
testchecks if all unit tests pass (jest)
test:watch - run tests in watch-modetest:cov - run tests and displays coverage (which should't get below 100%!)test:ci - run global tests and checks, including linting and flow errorsYou can build your own light version of setting the env.targets property in .babelrc to "node": "current".
The version deployed to npm requires at least NodeJS 6.0.0.
This library is a fork of another project of mine, node-lib-boilerplate.
This project is MIT licensed.
FAQs
Dependencyless JS library that converts a generic JSON-like object to a map-like, key-value object.
We found that json2kv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.