
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
PICA+ record processing
npm install pica-data (requires Node >= v16)
This EcmaScript Module contains utility functions to process PICA+ data.
The following serialization formats are supported:
plain)annotated)+, -, parsing (patch-plain)normalized)patch-normalized)Parsing from string is supported by exported function parsePica. The serialization format is passed as second argument or as option. The function always returns an array of records. Parsing errors result in skipped records unless option error is enabled.
import { parsePica } from "pica-data"
const records = parsePica(input, { format: "plain" })
Parsing from readable streams is supported by parser functions parseStream (returns a stream of records) and parseAll (returns a promise resolving in an array of records).
import { parseStream, parseAll } from "pica-data"
// transform stream
parseStream(process.stdin, { format: "plain" })
.on("data", record => console.log(record))
.on("error", ({message, line}) => console.error(`${message} on line ${line}`))
// promise stream to array
parseAll(process.stdin, { format: "plain"})
.then(records => console.log(records))
.catch(e => console.error(`${e.message} on line ${e.line}`))
In addition the function parsePicaLine can be used to parse a single line of PICA Plain (optionally annotated) into a PICA field.
To process PICA/XML as returned via SRU use xml2js and transform records with exported function fromXML:
import { fromXML, serializePica } from 'pica-data'
import createClient from '@natlibfi/sru-client'
createClient({
url:'https://sru.k10plus.de/opac-de-627', version: '1.1',
recordSchema: 'picaxml', recordFormat: 'object'
}).searchRetrieve('pica.tit=Beowulf')
.on('record', record => {
const pica = fromXML(record)
console.log(serializePica(pica))
})
serializePica to serialize a PICA record in PICA Plain syntax (optionally annotated)serializePicaField to serialize a PICA field in PICA Plain syntax (optionally annotated)picaFieldIdentifier to generate a field identifier from a field or from an Avram field schedulegetPPN to extract the PPN of a recordPicaPath to work with PICA Path expressions
fieldIdentifier to get the path's field identifier (tag and optional occurrence)tagString to get the path's PICA tag, without occurrenceoccurrenceString to get the path's occurrence (or an empty string)startOccurrence to get the path's start occurrence (or an empty string)endOccurrence to get the path's end occurrence (or an empty string)subfieldString to get the path's subfield identifier (or an empty string)toString to get field identifier and subfield identifier combinedmatchField(field) to check whether a PICA field matches the pathgetFields(record) to filter all matching PICA fieldsextractSubfields(field) to filter out all matching subfield valuesgetValues(record) to get a (possibly empty) array of matching subfield valuesgetUniqueValues(record) same as getValues but unique values onlypicaFieldSchedule to look up a field schedule for a given field in an Avram schemapicaFieldScheduleIdentifier to look up the field identifier of a field in an Avram schemaisPPN to check whether a string looks like a valid PPN (including checksum)ppnChecksum to calculate the checksum of a PPNPRs accepted against the dev branch. Never directly work on the main branch.
For releases (maintainers only) make changes on dev and then run the release script:
npm run release:patch # or minor or major
MIT License Verbundzentrale des GBV (VZG)
FAQs
EcmaScript utilities to process PICA+ data
We found that pica-data demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.