
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
node-unrtf
Advanced tools
Note An UnRTF v0.19.3 binary is included as an optional dependency for Windows users via node-unrtf-win32 which, due to its age, has several issues, such as the inability to convert RTF documents generated from 2007 onwards, and a bug in the
noPicturesoption that still generates pictures. It is recommended that whatever application is using thenode-unrtfmodule is run in a Linux environment using the latest available UnRTF binaries, which do not have these bugs.
Asynchronous Node.js wrapper for the UnRTF RTF conversion program
UnRTF is a CLI program that allows for the manipulation and extraction of data from RTF documents such as converting RTF files to HTML or TXT.
The node-unrtf module provides an asynchronous Node.js wrapper around said CLI program for easier use.
Install using npm:
npm i node-unrtf
For Linux and Mac users, the unrtf binary will need to be installed separately.
An example of downloading the binary on a Debian system:
sudo apt-get install unrtf
For macOS, the binary can be installed with Homebrew:
brew install unrtf
Please refer to the JSDoc comments in the source code or the generated type definitions for information on the available options.
Example of an async await call to convert an RTF file to HTML in an ESM environment:
import { UnRTF } from "node-unrtf";
const file = "test_document.rtf";
const unRtf = new UnRTF();
const options = {
outputHtml: true,
};
const res = await unRtf.convert(file, options);
console.log(res);
Example of calling unRTF.convert with a promise chain in a CJS environment:
const { UnRTF } = require("node-unrtf");
const file = "test_document.rtf";
const unRtf = new UnRTF("/usr/bin");
const options = {
outputHtml: true,
};
unRTF
.convert(file, options)
.then((res) => {
console.log(res);
return res;
})
.catch((err) => {
console.error(err);
throw err;
});
As mentioned in the note block at the top of this README, the noPictures option does not remove images
when used with UnRTF < v0.20.4 and will write them to the current working directory.
To remove images generated by UnRTF it is recommended to use a globbing module such as glob in conjunction with the node:fs/promises module to find and remove them:
import { unlink } from "node:fs/promises";
import { UnRTF } from "node-unrtf";
import { glob } from "glob";
const file = "test/files/test-rtf-complex.rtf";
const unRtf = new UnRTF();
const options = {
outputHtml: true,
noPictures: true,
};
await unRtf.convert(file, options);
const files = await glob("*.{emf,wmf}");
await Promise.all(files.map((filed) => unlink(filed)));
Contributions are welcome, and any help is greatly appreciated!
See the contributing guide for details on how to get started. Please adhere to this project's Code of Conduct when contributing.
node-unrtf is licensed under the MIT license.
FAQs
Asynchronous Node.js wrapper for the UnRTF RTF conversion program
The npm package node-unrtf receives a total of 158 weekly downloads. As such, node-unrtf popularity was classified as not popular.
We found that node-unrtf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.