Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rehype-remark
Advanced tools
rehype plugin that turns HTML into markdown to support remark.
This package is a unified (rehype) plugin that switches from rehype (the
HTML ecosystem) to remark (the markdown ecosystem).
It does this by transforming the current HTML (hast) syntax tree into a markdown
(mdast) syntax tree.
rehype plugins deal with hast and remark plugins deal with mdast, so plugins
used after rehype-remark
have to be remark plugins.
The reason that there are different ecosystems for markdown and HTML is that
turning markdown into HTML is, while frequently needed, not the only purpose of
markdown.
Checking (linting) and formatting markdown are also common use cases for
remark and markdown.
There are several aspects of markdown that do not translate 1-to-1 to HTML.
In some cases markdown contains more information than HTML: for example, there
are several ways to add a link in markdown (as in, autolinks: <https://url>
,
resource links: [label](url)
, and reference links with definitions:
[label][id]
and [id]: url
).
In other cases HTML contains more information than markdown: there are many
tags, which add new meaning (semantics), available in HTML that aren’t available
in markdown.
If there was just one AST, it would be quite hard to perform the tasks that
several remark and rehype plugins currently do.
unified is a project that transforms content with abstract syntax trees (ASTs). remark adds support for markdown to unified. rehype adds support for HTML to unified. mdast is the markdown AST that remark uses. hast is the markdown AST that rehype uses. This is a rehype plugin that transforms hast into mdast to support remark.
This project is useful when you want to turn HTML to markdown.
The remark plugin remark-rehype
does the inverse of this
plugin.
It turns markdown into HTML.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install rehype-remark
In Deno with esm.sh
:
import rehypeRemark from 'https://esm.sh/rehype-remark@10'
In browsers with esm.sh
:
<script type="module">
import rehypeRemark from 'https://esm.sh/rehype-remark@10?bundle'
</script>
Say we have the following module example.js
:
import rehypeParse from 'rehype-parse'
import rehypeRemark from 'rehype-remark'
import remarkStringify from 'remark-stringify'
import {fetch} from 'undici'
import {unified} from 'unified'
const response = await fetch('https://example.com')
const text = await response.text()
const file = await unified()
.use(rehypeParse)
.use(rehypeRemark)
.use(remarkStringify)
.process(text)
console.log(String(file))
Now running node example.js
yields:
# Example Domain
This domain is for use in illustrative examples in documents. You may use this domain in literature without prior coordination or asking for permission.
[More information...](https://www.iana.org/domains/example)
This package exports no identifiers.
The default export is rehypeRemark
.
unified().use(rehypeRemark[, destination][, options])
Turn HTML into markdown.
Transform (Transformer
).
rehypeRemark
are remark plugins (mutate mode)👉 Note: It’s highly unlikely that you want to pass a
processor
.
Options
Configuration (TypeScript type).
checked
(string
, default: '[x]'
)
— value to use for a checked checkbox or radio inputdocument
(boolean
, default: true
)
— whether the given tree represents a complete document; when the tree
represents a complete document, then things are wrapped in paragraphs
when needed, and otherwise they’re left as-ishandlers
(Record<string, Handle>
, optional)
— object mapping tag names to functions handling the corresponding
elements; merged into the defaults; see
Handle
in hast-util-to-mdast
newlines
(boolean
, default: false
)
— keep line endings when collapsing whitespace; the default collapses to a
single spacenodeHandlers
(Record<string, NodeHandle>
, optional)
— object mapping node types to functions handling the corresponding nodes;
merged into the defaults; see
NodeHandle
in hast-util-to-mdast
quotes
(Array<string>
, default: ['"']
)
— list of quotes to use; each value can be one or two characters; when two,
the first character determines the opening quote and the second the closing
quote at that level; when one, both the opening and closing quote are that
character; the order in which the preferred quotes appear determines which
quotes to use at which level of nesting; so, to prefer ‘’
at the first
level of nesting, and “”
at the second, pass ['‘’', '“”']
; if <q>
s
are nested deeper than the given amount of quotes, the markers wrap around:
a third level of nesting when using ['«»', '‹›']
should have double
guillemets, a fourth single, a fifth double again, etcunchecked
(string
, default: '[ ]'
)
— value to use for an unchecked checkbox or radio inputIt’s possible to exclude something from within HTML when turning it into
markdown, by wrapping it in an element with a data-mdast
attribute set to
'ignore'
.
For example:
<p><strong>Importance</strong> and <em data-mdast="ignore">emphasis</em>.</p>
Yields:
**Importance** and .
It’s also possible to pass a handler to ignore nodes, or create your own plugin that uses more advanced filters.
The goal of this project is to map HTML to plain and readable markdown.
That means that certain elements are ignored (such as <svg>
) or “downgraded”
(such as <video>
to links).
You can change this by passing handlers.
Say we have the following file example.html
:
<p>
Some text with
<svg viewBox="0 0 1 1" width="1" height="1"><rect fill="black" x="0" y="0" width="1" height="1" /></svg>
a graphic… Wait is that a dead pixel?
</p>
And our module example.js
looks as follows:
/**
* @typedef {import('mdast').Html} Html
*/
import {toHtml} from 'hast-util-to-html'
import rehypeParse from 'rehype-parse'
import rehypeRemark from 'rehype-remark'
import remarkStringify from 'remark-stringify'
import {read} from 'to-vfile'
import {unified} from 'unified'
const file = await unified()
.use(rehypeParse, {fragment: true})
.use(rehypeRemark, {
handlers: {
svg(state, node) {
/** @type {Html} */
const result = {type: 'html', value: toHtml(node)}
state.patch(node, result)
return result
}
}
})
.use(remarkStringify)
.process(await read('example.html'))
console.log(String(file))
Now running node example.js
yields:
Some text with <svg viewBox="0 0 1 1" width="1" height="1"><rect fill="black" x="0" y="0" width="1" height="1"></rect></svg> a graphic… Wait is that a dead pixel?
This package is fully typed with TypeScript.
It exports the additional type Options
.
More advanced types are exposed from hast-util-to-mdast
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, rehype-remark@^10
,
compatible with Node.js 16.
This plugin works with unified
version 6+, rehype-parse
version 3+ (used in
rehype
version 5), and remark-stringify
version 3+ (used in remark
version 7).
Use of rehype-remark
is safe by default.
remark-rehype
— remark plugin to turn markdown into HTMLremark-retext
— remark plugin to support retextrehype-retext
— rehype plugin to support retextSee contributing.md
in rehypejs/.github
for ways
to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
rehype plugin to transform to remark
The npm package rehype-remark receives a total of 73,527 weekly downloads. As such, rehype-remark popularity was classified as popular.
We found that rehype-remark demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.