Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
parse-strings-in-object
Advanced tools
JavaScript is notoriously loose with typing, so this can get you into trouble. For example, you might get configuration or JSON including strings as values:
'isMaster': 'true',
myNumber: '0'
So, now:
console.log(isMaster); // "true": as expected, but actually string
console.log(isMaster==true, isMaster===true); // "false false": oops
console.log(myNumber); // "0": as expected, but actually a string
console.log(typeof myNumber, myNumber==0, myNumber===0); // "string true false": hmmm
console.log(!myNumber); // "true": this is getting confusing
This simple module reads your JS Object recursively and converts string values to their proper types.
Install from npm:
npm install parse-strings-in-object
There is only one argument to pass to the module - a valid JavaScript object.
var niceParsedObject = require('parse-strings-in-object')(yourOriginalObject)
let before = {
topLevel: true,
topNumber: 1,
justAString: 'hello',
ipAddress: '192.168.1.101'
}
let after = require('parse-strings-in-object')(before);
console.log('before:', before);
console.log('after:', JSON.stringify(after, null, 4));
The output will be:
{
"topLevel": true,
"topNumber": 1,
"justAString": "hello",
"ipAddress": "192.168.1.101"
}
Feel free to improve the module! All pull requests shall be considered.
After npm install
you can run unit tests with Mocha like this:
npm run test
FAQs
Convert string values in object to boolean and numbers
The npm package parse-strings-in-object receives a total of 1,453 weekly downloads. As such, parse-strings-in-object popularity was classified as popular.
We found that parse-strings-in-object demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.