
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A compact and deterministic length-prefixed serialization format with a minimal, unambiguous grammar.
LNP is a compact, deterministic, length-prefixed data serialization format. It encodes structured data (objects, arrays, primitives, and binary) using a minimal grammar and unambiguous parsing rules. The design goal is to provide a simple, stream-friendly, and implementation-agnostic protocol suitable for storage, messaging, and structured binary or textual data exchange.
Every value is encoded as:
<type-char><byte-length>:<payload-bytes>
Where:
<type-char> — a single ASCII character indicating the value type<byte-length> — decimal ASCII length of the payload in bytes: — required separator<payload-bytes> — exactly <byte-length> bytes of contentThis eliminates the need for delimiters, escaping, or structural markers. All nested values remain valid LNP values.
| Type | Char | Payload Description |
|---|---|---|
| Object | o | Sequence of entries <klen>:<kbytes><value> |
| Array | a | Sequence of complete LNP values |
| String | s | Raw UTF-8 string bytes |
| Number | n | ASCII numeric representation (-12, 3.14, etc.) |
| Boolean | b | Single byte: t or f |
| Null | N | Must have zero-length payload |
| Bytes | B | Base64-encoded bytes (or raw bytes, implementation defined) |
Object payloads consist of repeated entries:
<key-length>:<key-bytes><value>
Where <value> is a complete LNP value including its type and length prefix.
Example:
o27:name4:Johnage2:n24
Represents:
{
"name": "John",
"age": 24
}
Arrays concatenate multiple full LNP values inside the payload:
a14s3:foos3:bar
Equivalent to:
["foo", "bar"]
s5:hello
n4:-2.5
b1:t // true
b1:f // false
N0:
B12:SGVsbG8gV29ybGQ=
value = typeChar length ":" payload ;
typeChar = "o" | "a" | "s" | "n" | "b" | "N" | "B" ;
length = digits ;
digits = digit { digit } ;
payload = bytes(length) ;
object = "o" length ":" { entry } ;
entry = digits ":" bytes(keylen) value ;
array = "a" length ":" { value } ;
bytes(n) means exactly n raw bytes, without interpretation.
FAQs
A compact and deterministic length-prefixed serialization format with a minimal, unambiguous grammar.
We found that lnp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.