
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
npm-markdown-bugs
Advanced tools
Here are a few Markdown bugs I've found while viewing READMEs on npmjs.com. For comparison, all of these view fine on GitHub using the same Markdown syntax.
When indenting code using real tabs (not spaces), npmjs.com renders it with very odd spacing:
var server = new PixlServer({
__name: 'MyServer',
__version: "1.0",
config: {
"log_dir": "/var/log",
"debug_level": 9,
"Storage": {
"engine": "File",
"File": {
"base_dir": "/var/data/myserver"
}
},
"WebServer": {
"http_port": 80,
"http_htdocs_dir": "/var/www/html"
},
"API": {
"base_uri": "/api"
},
"User": {
"free_accounts": 0,
"sort_global_users": 1
}
},
components: [
require('pixl-server-storage'),
require('pixl-server-web'),
require('pixl-server-api'),
require('pixl-server-user')
]
});
Basically, anything nested more than one tab deep is collapsed to the left side.
UPDATE: This appears to be a browser-specific issue. Safari v9.0.2 seems to render the nested tabs correctly, while Chrome v47 and Firefox v43 do not.
Tabs in code snippets are rendered extremely wide on npmjs.com. This here is one single tab:
{
"code": 0,
"location": "http://mycompany.com/usermanager/login.php?return="
}
Because the npmjs.com page content is locked at 740px width, it would be highly recommended to reduce the tab width, to about half of what it is.
Nested lists don't seem to indent properly, especially when mixing numbered and bullet lists:
Nested lists seem to have a spacing issue below them:
Here is text below a list. On npmjs.com this text is crammed up against the list bottom.
Table content should align left unless explicitly set otherwise. On npmjs.com it is all centered by default:
| Header 1 | Header 2 | Header 3 |
|---|---|---|
| Sample 1 | Sample 2 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. |
| Sample 1 | Sample 2 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. |
| Sample 1 | Sample 2 | Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. |
Note: I am specifically referring to the table content, not the headers.
The following is a simple ASCII box with text inside:
┌───────────────────────────────────────────────┐
│ The quick brown fox jumped over the lazy dog. │
└───────────────────────────────────────────────┘
And this is an ASCII table with several rows and columns:
┌──────────┬────────────────┬───────────────────┬───────────────┐
│ Username │ Full Name │ Email Address │ Status │
├──────────┼────────────────┼───────────────────┼───────────────┤
│ jhuckaby │ Joseph Huckaby │ jhuckaby@test.com │ Administrator │
│ tsmith │ Tom Smith │ smith@email.com │ Active │
│ dcook │ David Cook │ dcook@hotmail.com │ Suspended │
└──────────┴────────────────┴───────────────────┴───────────────┘
Both of these appear garbled on npmjs.com, with everything misaligned. I believe the font being used for text blocks is not truly monospace, and several of the ASCII art characters are actually double-width, when they should be single-width.
Specifically, I believe the ─ character is being rendered double-width, and the ├ character is also misaligned.
These boxes and tables appear fine on GitHub, and in various text editors and terminals I have tried.
Test.
Test 2023-02-02.
FAQs
Some example markdown bugs seen on npmjs.com.
We found that npm-markdown-bugs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.