Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
micromark-extension-mdx-expression
Advanced tools
micromark extension to support MDX or MDX JS expressions
The micromark-extension-mdx-expression npm package is designed to extend the micromark Markdown parser to support MDX expressions. This allows developers to embed JSX-like expressions within their Markdown content, which is particularly useful when using MDX to create interactive documentation or components within Markdown files.
Parsing Inline Expressions
This feature allows the parsing of inline expressions embedded within curly braces. It is useful for inserting dynamic content directly into the text.
{`Hello, ${name}!`}
Parsing Block Expressions
This feature supports the use of block expressions, where more complex JavaScript logic can be embedded within Markdown, enabling the creation of dynamic and interactive content blocks.
{
const name = 'World';
return <div>Hello, {name}!</div>;
}
This package is similar to micromark-extension-mdx-expression as it also allows MDX capabilities in Markdown files. However, remark-mdx is built on top of the remark parser, which is a different Markdown parser compared to micromark used by micromark-extension-mdx-expression. This difference in underlying parsers can lead to variations in parsing behavior and plugin compatibility.
micromark extension to support MDX expressions ({Math.PI}
).
{
$type
in code: expected an object spread ({...spread}
)This package contains an extension that adds support for the expression syntax
enabled by MDX to micromark
.
These extensions are used inside MDX.
This package can be made aware or unaware of JavaScript syntax. When unaware, expressions could include Rust or variables or whatnot.
This project is useful when you want to support expressions in markdown.
You can use this extension when you are working with micromark
.
To support all MDX features, use
micromark-extension-mdxjs
instead.
When you need a syntax tree, combine this package with
mdast-util-mdx-expression
.
All these packages are used in remark-mdx
, which focusses on
making it easier to transform content by abstracting these internals away.
When you are using mdx-js/mdx
, all of this is already included.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install micromark-extension-mdx-expression
In Deno with esm.sh
:
import {mdxExpression} from 'https://esm.sh/micromark-extension-mdx-expression@2'
In browsers with esm.sh
:
<script type="module">
import {mdxExpression} from 'https://esm.sh/micromark-extension-mdx-expression@2?bundle'
</script>
import {Parser} from 'acorn'
import acornJsx from 'acorn-jsx'
import {micromark} from 'micromark'
import {mdxExpression} from 'micromark-extension-mdx-expression'
// Unaware of JavaScript (“agnostic”) (balanced braces):
const output = micromark('a {1 + 1} b', {extensions: [mdxExpression()]})
console.log(output)
// Aware of JavaScript:
micromark('a {!} b', {extensions: [mdxExpression({acorn: Parser.extend(acornJsx())})]})
Yields:
<p>a b</p>
[1:5: Could not parse expression with acorn] {
ancestors: undefined,
cause: SyntaxError: Unexpected token
at pp$4.raise (file:///Users/tilde/Projects/oss/micromark-extension-mdx-expression/node_modules/acorn/dist/acorn.mjs:3547:13)
at pp$9.unexpected (file:///Users/tilde/Projects/oss/micromark-extension-mdx-expression/node_modules/acorn/dist/acorn.mjs:758:8)
…
pos: 4,
loc: { line: 1, column: 4 },
raisedAt: 1
},
column: 5,
fatal: undefined,
line: 1,
place: { line: 1, column: 5, offset: 4 },
reason: 'Could not parse expression with acorn',
ruleId: 'acorn',
source: 'micromark-extension-mdx-expression',
url: 'https://github.com/micromark/micromark-extension-mdx-expression/tree/main/packages/micromark-extension-mdx-expression#could-not-parse-expression-with-acorn'
}
…which is useless: go to a syntax tree with
mdast-util-from-markdown
and
mdast-util-mdx-expression
instead.
This package exports the identifier mdxExpression
.
There is no default export.
The export map supports the development
condition.
Run node --conditions development module.js
to get instrumented dev code.
Without this condition, production code is loaded.
mdxExpression(options?)
Create an extension for micromark
to enable MDX expression syntax.
options
(Options
, optional)
— configurationExtension for micromark
that can be passed in extensions
to enable MDX
expression syntax (Extension
).
Configuration (TypeScript type).
acorn
(Acorn
, optional)
— acorn parser to useacornOptions
(AcornOptions
, default:
{ecmaVersion: 2024, locations: true, sourceType: 'module'}
)
— configuration for acorn; all fields except locations
can be setaddResult
(boolean
, default: false
)
— whether to add estree
fields to tokens with results from acornWhen authoring markdown with JavaScript, keep in mind that MDX is a whitespace sensitive and line-based language, while JavaScript is insensitive to whitespace. This affects how markdown and JavaScript interleave with eachother in MDX. For more info on how it works, see § Interleaving on the MDX site.
This extension supports MDX both aware and unaware to JavaScript (respectively gnostic and agnostic). Depending on whether acorn is passed, either valid JavaScript must be used in expressions, or arbitrary text (such as Rust code or so) can be used.
There are two types of expressions: in text (inline, span) or in flow (block).
They start with {
.
Depending on whether acorn
is passed, expressions are either parsed in several
tries until whole JavaScript is found (as in, nested curly braces depend on JS
expression nesting), or they are counted and must be balanced.
Expressions end with }
.
For flow (block) expressions, optionally markdown spaces (
or \t
) can occur
after the closing brace, and finally a markdown line ending (\r
, \n
) or the
end of the file must follow.
While markdown typically knows no errors, for MDX it is decided to instead throw on invalid syntax.
Here is an expression in a heading:
## Hello, {1 + 1}!
In agnostic mode, balanced braces can occur: {a + {b} + c}.
In gnostic mode, the value of the expression must be JavaScript, so
this would fail: {!}.
But, in gnostic mode, braces can be in comments, strings, or in other
places: {1 /* { */ + 2}.
The previous examples were text (inline, span) expressions, they can
also be flow (block):
{
1 + 1
}
This is incorrect, because there are further characters:
{
1 + 1
}!
Blank lines cannot occur in text, because markdown has already split them in
separate constructs, so this is incorrect: {1 +
1}
In flow, you can have blank lines:
{
1 +
2
}
{
This error occurs if a {
was seen without a }
(source:
micromark-extension-mdx-expression
, rule id: unexpected-eof
).
For example:
a { b
This error occurs if a {
was seen in a container which then has lazy content
(source: micromark-extension-mdx-expression
, rule id: unexpected-lazy
).
For example:
> {a
b}
$type
in code: expected an object spread ({...spread}
)This error occurs if a spread was expected but something else was found
(source: micromark-extension-mdx-expression
, rule id: non-spread
).
For example:
<a {b=c}={} d>
This error occurs if a spread was expected but more was found after it
(source: micromark-extension-mdx-expression
, rule id: spread-extra
).
For example:
<a {...b,c} d>
This error occurs if acorn crashes or when there is more content after a JS
expression (source: micromark-extension-mdx-expression
, rule id: acorn
).
For example:
a {"b" "c"} d
a {var b = "c"} d
Two tokens are used, mdxFlowExpression
and mdxTextExpression
, to reflect
flow and text expressions.
They include:
lineEnding
for the markdown line endings \r
, \n
, and \r\n
mdxFlowExpressionMarker
and mdxTextExpressionMarker
for the braceswhitespace
for markdown spaces and tabs in blank linesmdxFlowExpressionChunk
and mdxTextExpressionChunk
for chunks of
expression contentThis package is fully typed with TypeScript.
It exports the additional type Options
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line,
micromark-extension-mdx-expression@^2
, compatible with Node.js 16.
This package works with micromark
version 3
and later.
This package is safe.
micromark-extension-mdxjs
— support all MDX syntaxmdast-util-mdx-expression
— support MDX expressions in mdastremark-mdx
— support all MDX syntax in remarkSee contributing.md
in micromark/.github
for ways to get
started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
micromark extension to support MDX or MDX JS expressions
The npm package micromark-extension-mdx-expression receives a total of 1,491,590 weekly downloads. As such, micromark-extension-mdx-expression popularity was classified as popular.
We found that micromark-extension-mdx-expression demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.