
Security News
/Company News
Socket Is Sponsoring Composer and Packagist
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
Provides facilities for reading and writing Plist (property list) files. These are often used in programming OS X and iOS applications, as well as the iTunes configuration XML file.
Plist files represent stored programming "object"s. They are very similar to JSON. A valid Plist file is representable as a native JavaScript Object and vice-versa.
Install using npm:
$ npm install plist
Then import the parse() and build() functions:
import { parse, build } from 'plist';
const val = parse('<plist><string>Hello World!</string></plist>');
console.log(val); // "Hello World!"
Use an import map to resolve the bare module specifiers used by plist and its dependencies, then import directly from the source:
<script type="importmap">
{
"imports": {
"@xmldom/xmldom": "https://esm.sh/@xmldom/xmldom",
"xmlbuilder": "https://esm.sh/xmlbuilder"
}
}
</script>
<script type="module">
import { parse, build } from './node_modules/plist/index.js';
const val = parse('<plist><string>Hello World!</string></plist>');
console.log(val); // "Hello World!"
</script>
See the browser example for a drag-and-drop demo.
Parsing a plist from filename:
import { readFileSync } from 'node:fs';
import { parse } from 'plist';
const obj = parse(readFileSync('myPlist.plist', 'utf8'));
console.log(JSON.stringify(obj));
Parsing a plist from string payload:
import { parse } from 'plist';
const xml =
'<?xml version="1.0" encoding="UTF-8"?>' +
'<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">' +
'<plist version="1.0">' +
'<key>metadata</key>' +
'<dict>' +
'<key>bundle-identifier</key>' +
'<string>com.company.app</string>' +
'<key>bundle-version</key>' +
'<string>0.1.1</string>' +
'<key>kind</key>' +
'<string>software</string>' +
'<key>title</key>' +
'<string>AppName</string>' +
'</dict>' +
'</plist>';
console.log(parse(xml));
// [
// "metadata",
// {
// "bundle-identifier": "com.company.app",
// "bundle-version": "0.1.1",
// "kind": "software",
// "title": "AppName"
// }
// ]
Given an existing JavaScript Object, you can turn it into an XML document that complies with the plist DTD:
import { build } from 'plist';
const obj = [
"metadata",
{
"bundle-identifier": "com.company.app",
"bundle-version": "0.1.1",
"kind": "software",
"title": "AppName"
}
];
console.log(build(obj));
// <?xml version="1.0" encoding="UTF-8"?>
// <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
// <plist version="1.0">
// <key>metadata</key>
// <dict>
// <key>bundle-identifier</key>
// <string>com.company.app</string>
// <key>bundle-version</key>
// <string>0.1.1</string>
// <key>kind</key>
// <string>software</string>
// <key>title</key>
// <string>AppName</string>
// </dict>
// </plist>
simple-plist is another npm package that provides similar functionality to plist. It allows for reading and writing plist files. Compared to plist, simple-plist may offer a simpler API and potentially fewer features, focusing on basic plist operations.
bplist-parser is a package specifically designed to parse binary plist files. While plist handles both XML and binary formats, bplist-parser is optimized for binary plists, which might make it faster or more efficient for that specific use case.
FAQs
Apple's property list parser/builder for Node.js and browsers
The npm package plist receives a total of 13,263,308 weekly downloads. As such, plist popularity was classified as popular.
We found that plist demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.

Research
/Security News
Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.