
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
query-json-js
Advanced tools
query-json is a faster, simpler and more portable implementation of the jq language in OCaml distributed as a binary, but also distributed as a JavaScript package via js_of_ocaml.
query-json allows you to write small programs to operate on top of json files with a concise syntax.
It was created with mostly two reasons in mind, learning and having fun
menhir, sedlex and friends and try to make great error messages.$ query-json '.esy.release.wat' esy.json
Error: Trying to ".wat" on an object, that don't have the field "wat":
{ "bin": ... }
debug prints the tokens and the AST.verbose flag, prints each operation in each state and it's intermediate states. (Work in progress...)filter(p) as an alias for map(select(p))Check the content of scripts/install.sh before running anything in your local. Friends don't let friends curl | bash.
curl -sfL https://raw.githubusercontent.com/davesnx/query-json/master/scripts/install.sh | bash
npm install --global @davesnx/query-json
I recommend to write the query in single-quotes inside the terminal, since writting JSON requires double-quotes for accessing properties.
NOTE: I have aliased query-json to "q" for short, you can set it in your dotfiles with
alias q="query-json".
query-json '.' pokemons.json
cat pokemons.json | query-json '.'
query-json '.' <<< '{ "bulvasur": { "id": 1, "power": 20 } }'
query-json --kind=inline '.' '{ "bulvasur": { "id": 1, "power": 20 } }'
query-json '.' pokemons.json --no-colors
This report is not an exhaustive performance report of both tools, it's a overview for the percieved performance of the user. I don't profile each tool and try to see what are the bootlenecks, since I assume that both tools have the penalty of parsing a JSON file.
Aside from that, query-json doesn't have feature parity with jq which is ok at this point, but jq contains a ton of functionality that query-json misses. Adding the missing operations on query-json won't affect the performance of it, that could not be true for features like "modules", "functions" or "tests".
The report shows that query-json is between 2x and 5x faster than jq in all operations tested and same speed (~1.1x) with huge files (> 100M).
| Badge | Meaning |
|---|---|
| ✅ | Implemented |
| ⚠️ | Not implemented yet |
| 🔴 | Won't implement |
--version ✅--kind. This is different than jq ✅
--kind=file and the 2nd argument can be a json file--kind=inline and the 2nd argument can be a json as a string--no-color. This disables colors ✅. ✅.foo, .foo.bar ✅.foo? ✅.[<string>] ✅.[2] ✅| ✅.[10:15] ⚠️.[] ⚠️, ✅() ✅️+ ✅- ✅*, /, and % ✅length ✅keys ✅map ✅select ✅has(key) ⚠️in ⚠️path(path_expression) ⚠️to_entries, from_entries, with_entries ⚠️any, any(condition), any(generator; condition) ⚠️all, all(condition), all(generator; condition) ⚠️flatten ✅range(upto), range(from;upto) range(from;upto;by) ⚠️floor, sqrt ⚠️tonumber, tostring ⚠️type ⚠️infinite, nan, isinfinite, isnan, isfinite, isnormal ⚠️sort, sort_by(path_expression) ✅group_by(path_expression) ⚠️min, max, min_by(path_exp), max_by(path_exp) ⚠️unique, unique_by(path_exp) ⚠️reverse ⚠️contains(element) ⚠️index(s), rindex(s) ⚠️startswith(str), endswith(str) ⚠️explode, implode ⚠️split(str), join(str) ⚠️while(cond; update), until(cond; next) ⚠️recurse(f), recurse, recurse(f; condition), recurse_down ⚠️walk(f) ⚠️transpose(f) ⚠️@text, @csv, etc.. 🔴==, != ✅if-then-else ⚠️>, >=, <=, < ✅and, or, not ⚠️break 🔴Contributions are what make the open source community such an amazing place to be, learn, inspire, and create. Any contributions you make are greatly appreciated. If you have any questions just contact me @twitter or email dsnxmoreno at gmail dot com.
I usually hang out at discord.gg/reasonml or x.com/davesnx so feel free to ask anything.
Requirements: opam
git clone https://github.com/davesnx/query-json
cd query-json
make init # creates opam switch, installs ocaml deps and npm deps
make dev-core # compiles query-json "core" only
make test # runs unit tests and snapshots tests
dune exec query-json # Run binary
Running the playground
# In different terminals
make dev # compiles all packages "query-json" "query-json-s" and "query-json-playground", and runs the bundler
make web-dev # Runs bundler
FAQs
Unknown package
We found that query-json-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.