Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Tiny, forgiving HTML parser in JavaScript. This module started life as code from John Resig and has evolved and morphed over the years of hardening and use in Krux's postscribe library. This library doesn't aim for the greatest level of compliance, but rather to be as forgiving of real-life code encountered in scenarios like ad serving.
If you just want to use the script without installing anything:
<script src="dist/prescribe.min.js"></script>
You can include prescribe
using npm:
npm install --save prescribe
This script runs in browsers, so this assumes you're using a module bundler like webpack, Browserify, JSPM or Rollup to consume CommonJS modules.
import HtmlParser from 'prescribe';
define(['prescribe'], function(HtmlParser) {
});
var HtmlParser = require('prescribe');
This module is meant to parse any HTML that you can throw at it and do something meaningful, and we've taken care to make sur that it works on every browser we can get our hands on. We expect it to work on every browser built after 2009. There are over 30 unit tests that run on every commit. Prescribe is thoroughly tested and known to work well in the following browsers:
Note that we do not provide any support for Internet Explorer versions earlier than IE8.
We ♥ bug reports.
Have a problem? Need help? Would you like additional functionality added? We use GitHub's ticket system for keeping track of these requests.
Please check out the existing issues, and if you don't see that your problem is already being worked on, please file a new issue. The more information the better to describe your problem.
We ♥ forks and pull requests.
Please see CONTRIBUTING.md for full details.
The project requires nodejs (>=5.6) and npm (>=3.6.0) for development. It has no runtime dependencies.
Check the code out and install the development dependencies using:
npm install
To build the code, run
npm run build
We use ESLint and JSCS to do static analysis of the JavaScript and keep things smelling good. To run both, use:
npm run lint
Using travis-ci, the Mocha unit tests are run on every commit using PhantomJS to run the tests with a real browser.
To test the code locally, you can use:
npm test
To run tests in Test-Driven-Development mode, where the test will be run after every change, use:
npm run tdd
To run the cross-browser tests, use:
npm run test:cross-browser
Please either add a failing unit test or include a jsfiddle that distills and reproduces the issue.
We aim for you to use this inside your application, so we picked the least restrictive license we could find: the MIT license.
See LICENSE.
FAQs
Tiny, forgiving HTML parser
We found that prescribe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.