Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
By Kush Pandya - Apr 18, 2025
You're Invited: Meet the Socket team at BSidesSF and RSAC - April 27 - May 1.RSVP →
rehype-document
Advanced tools
rehype-document
rehype plugin to wrap a document around a fragment.
Install
npm:
npm install rehype-document
This package comes with types.
If you’re using TypeScript, make sure to also install
@types/hast.
Use
Say example.md looks as follows:
## Hello world!
This is **my** document.
…and example.js like this:
var vfile = require('to-vfile')
var report = require('vfile-reporter')
var unified = require('unified')
var parse = require('remark-parse')
var mutate = require('remark-rehype')
var stringify = require('rehype-stringify')
var doc = require('rehype-document')
unified()
.use(parse)
.use(mutate)
.use(doc, {title: 'Hi!'})
.use(stringify)
.process(vfile.readSync('example.md'), function(err, file) {
console.error(report(err || file))
console.log(String(file))
})
Now, running node example yields:
example.md: no issues found
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Hi!</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<h2>Hello world!</h2>
<p>This is <strong>my</strong> document.</p>
</body>
</html>
API
rehype().use(document[, options])
Wrap a document around a fragment.
options
options.title
Text to use as title (string, default: name of file, if any).
options.language
Natural language of document (string, default: 'en').
should be a BCP 47 language tag.
options.responsive
Whether to insert a meta[viewport] (boolean, default: true).
options.doctype
Doctype to use (string, default: '5').
options.style
CSS to include in head in <style> elements (string or Array.<string>,
default: []).
options.css
Links to stylesheets to include in head (string or Array.<string>,
default: []).
options.meta
Metadata to include in head (Object or Array.<Object>, default: []).
Each object is passed as properties to hastscript with a
meta element.
options.link
Link tags to include in head (Object or Array.<Object>, default: []).
Each object is passed as properties to hastscript with a
link element.
options.script
Inline scripts to include at end of body (string or Array.<string>,
default: []).
options.js
External scripts to include at end of body (string or Array.<string>,
default: []).
Security
Use of rehype-document can open you up to a cross-site scripting (XSS)
attack if you pass user provided content in options.
Always be wary of user input and use rehype-sanitize.
Related
rehype-format— Format HTMLrehype-minify— Minify HTML
Contribute
See contributing.md in rehypejs/.github for ways
to get started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
License
FAQs
rehype plugin to wrap a document around a fragment
The npm package rehype-document receives a total of 8,311 weekly downloads. As such, rehype-document popularity was classified as popular.
We found that rehype-document demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Package last updated on 29 Apr 2020
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Security News
Python Tools Are Quickly Adopting the New pylock.toml Standard
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
By Sarah Gooding - Apr 18, 2025
Product
Go Support Is Now Generally Available
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.
By Peter van der Zee, Ryan Eberhardt - Apr 17, 2025