
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
pygmentize-bundled
Advanced tools
A simple wrapper around Python's Pygments code formatter, with Pygments bundled
Python's Pygments code formatter, for Node.js, distributed with Pygments
Can be used as either a String-in, Buffer-out, or as a Duplex stream.
Compatible with both Python v2 and v3.
Note: this library makes use of a child process which calls Python to invoke Pygments. This can cause performance problems where a large number of code blocks are being separately formatted. Consider using pygmentize-bundled-cached, an API-compatible wrapper for this library that keeps an on-disk cache of formatted code samples which will result in significantly faster formats when repeatedly formatting the same blocks of code.
pygmentize(options, code, callback)
Pygmentize a given code string and return it as a Buffer to the callback Function.
options contains options to be passed to Pygments (see Options).code is a String to be formatted.callback is a Function, called when complete. The first argument will be an error object/string if there was a problem and the second argument will be a Buffer containing your formatted code.pygmentize(options)
When you only supply the options argument, it will return a Duplex stream that you can pipe to and from to format your code.
options contains options to be passed to Pygments (see Options).Language/lexer, formatter, and their options are currently supported. Filters are not supported yet.
lang: source language/lexer name - Stringformat: output formatter name - Stringpython: the full path to the python command on the current system, defaults to 'python' - Stringoptions: lexer and formatter options, each key/value pair is passed through to pygmentize with -P - ObjectThe string interface is very simple:
var pygmentize = require('pygmentize-bundled')
pygmentize({ lang: 'js', format: 'html' }, 'var a = "b";', function (err, result) {
console.log(result.toString())
})
Results in:
<div class="highlight"><pre>
<span class="kd">var</span>
<span class="nx">a</span>
<span class="o">=</span>
<span class="s2">"b"</span>
<span class="p">;</span>
</pre></div>
Example with extra options:
var pygmentize = require('pygmentize-bundled')
pygmentize({ lang: 'php', format: 'html', options: { startinline: 1 } }, 'var a = true;', function (err, result) {
console.log(result.toString())
})
A duplex streaming API is also available. Simply omit the code and callback arguments:
var pygmentize = require('pygmentize-bundled')
process.stdin
.pipe(pygmentize({ lang: 'js', format: 'html' }))
.pipe(process.stdout);
Refer to the Pygments documentation. For supported languages, see the list of lexers, for supported formatted, see the list of formatters.
Pygments (Bundled) is Copyright (c) 2012 Rod Vagg <@rvagg> and licenced under the MIT licence. All rights not explicitly granted in the MIT license are reserved. See the included LICENSE file for more details.
Pygments is licenced under the BSD licence.
FAQs
A simple wrapper around Python's Pygments code formatter, with Pygments bundled
The npm package pygmentize-bundled receives a total of 3,343 weekly downloads. As such, pygmentize-bundled popularity was classified as popular.
We found that pygmentize-bundled demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.