Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
micromark-util-resolve-all
Advanced tools
The micromark-util-resolve-all npm package is a utility library designed to work with the micromark Markdown parser. It provides functionality to resolve all constructs (like tokens and events) in the micromark syntax tree, making it easier to manipulate and transform Markdown documents programmatically. This package is particularly useful for developers working on Markdown processing tools, plugins, or applications that require a deep integration with the Markdown parsing and rendering process.
Resolving constructs
This feature allows you to resolve all constructs in a micromark syntax tree. The code sample demonstrates how to use the `resolveAll` function by passing an array of events (which you would typically get from the micromark parser) and a context object. The function returns a new array of events where all constructs have been resolved, making it easier to further process or manipulate the Markdown document.
"use strict";
var resolveAll = require('micromark-util-resolve-all');
var events = [/* an array of events from micromark */];
var context = {/* some context */};
var resolvedEvents = resolveAll(events, context);
remark-parse is a plugin for the remark Markdown processor that parses Markdown content into a syntax tree. While it serves a similar purpose in parsing Markdown, remark-parse is part of the unified.js ecosystem and focuses more on the parsing aspect, providing a higher-level abstraction compared to micromark-util-resolve-all, which is more focused on resolving constructs within the micromark syntax tree.
markdown-it is a fast and extensible Markdown parser and renderer. It is similar to micromark-util-resolve-all in that it allows for detailed manipulation and extension of the Markdown parsing process. However, markdown-it is a complete Markdown processing solution, offering both parsing and rendering capabilities out of the box, whereas micromark-util-resolve-all is a utility library designed to work within the micromark ecosystem for resolving constructs.
micromark utility to resolve subtokens.
Resolvers are functions that take events and manipulate them. This is needed for example because media (links, images) and attention (strong, italic) aren’t parsed left-to-right. Instead, their openings and closings are parsed, and when done, their openings and closings are matched, and left overs are turned into plain text. Because media and attention can’t overlap, we need to perform that operation when one closing matches an opening, too.
This package exposes a micromark internal that you probably don’t need.
This package might be useful when you are making your own micromark extensions.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install micromark-util-resolve-all
In Deno with esm.sh
:
import {resolveAll} from 'https://esm.sh/micromark-util-resolve-all@1'
In browsers with esm.sh
:
<script type="module">
import {resolveAll} from 'https://esm.sh/micromark-util-resolve-all@1?bundle'
</script>
import {push} from 'micromark-util-chunked'
import {resolveAll} from 'micromark-util-resolve-all'
/**
* @type {Resolver}
*/
function resolveAllAttention(events, context) {
// …
// Walk through all events.
while (++index < events.length) {
// Find a token that can close.
if (
events[index][0] === 'enter' &&
events[index][1].type === 'attentionSequence' &&
events[index][1]._close
) {
open = index
// Now walk back to find an opener.
while (open--) {
// Find a token that can open the closer.
if (
// …
) {
// …
// Opening.
nextEvents = push(nextEvents, [
// …
])
// Between.
nextEvents = push(
nextEvents,
resolveAll(
context.parser.constructs.insideSpan.null,
events.slice(open + 1, index),
context
)
)
// Closing.
nextEvents = push(nextEvents, [
// …
])
// …
}
}
}
}
// …
}
This module exports the identifier resolveAll
.
There is no default export.
resolveAll(constructs, events, context)
Call all resolveAll
s in constructs
.
constructs
(Array<Construct>
)
— list of constructs, optionally with resolveAll
sevents
(Array<Event>
)
— list of eventscontext
(TokenizeContext
)
— context used by tokenize
Changed events (Array<Events>
).
This package is fully typed with TypeScript. It exports no additional types.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line,
micromark-util-resolve-all@2
, compatible with Node.js 16.
This package works with micromark@3
.
This package is safe.
See security.md
in micromark/.github
for how to
submit a security report.
See contributing.md
in micromark/.github
for ways
to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.
FAQs
micromark utility to resolve subtokens
The npm package micromark-util-resolve-all receives a total of 5,799,952 weekly downloads. As such, micromark-util-resolve-all popularity was classified as popular.
We found that micromark-util-resolve-all demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.