Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
remark-cli
Advanced tools
remark-cli is a command-line interface for the remark processor, which is a tool for processing Markdown content. It allows you to lint, format, and transform Markdown files using plugins.
Linting Markdown files
This command lints all Markdown files in the current directory using the recommended linting rules provided by the 'remark-preset-lint-recommended' plugin.
remark . --use remark-preset-lint-recommended
Formatting Markdown files
This command formats all Markdown files in the current directory and writes the changes back to the files. The '--output' flag specifies that the changes should be saved.
remark . --output
Transforming Markdown files with plugins
This command transforms all Markdown files in the current directory to HTML using the 'remark-html' plugin and writes the changes back to the files.
remark . --use remark-html --output
markdownlint-cli is a command-line interface for the markdownlint library, which is used to lint Markdown files. It focuses primarily on linting and does not offer the same level of extensibility with plugins as remark-cli.
Prettier is an opinionated code formatter that supports multiple file types, including Markdown. While it is primarily used for formatting, it does not offer the same level of Markdown-specific linting and transformation capabilities as remark-cli.
markdown-it is a Markdown parser that can be extended with plugins. It is more focused on parsing and rendering Markdown to HTML, and does not provide a command-line interface or the same level of linting and formatting capabilities as remark-cli.
Command line interface to inspect and change markdown files with remark.
This package is a command line interface (CLI) that you can use in your terminal or in npm scripts and the like to inspect and change markdown files. This CLI is built around remark, which is an ecosystem of plugins that work with markdown as structured data, specifically ASTs (abstract syntax trees). You can choose from the 150+ existing plugins or make your own.
See the monorepo readme for info on what the remark ecosystem is.
You can use this package when you want to work with the markdown files in your
project from the command line.
remark-cli
has many options and you can combine it with many plugins, so it
should be possible to do what you want.
If not, you can always use remark
itself manually in a script.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install remark-cli
Add a table of contents with remark-toc
to readme.md
:
remark readme.md --output --use remark-toc
Lint all markdown files in the current directory according to the markdown style
guide with remark-preset-lint-markdown-style-guide
.
remark . --use remark-preset-lint-markdown-style-guide
The interface of remark-cli
is explained as follows on its help page
(remark --help
):
Usage: remark [options] [path | glob ...]
CLI to process markdown with remark
Options:
--[no-]color specify color in report (on by default)
--[no-]config search for configuration files (on by default)
-e --ext <extensions> specify extensions
--file-path <path> specify path to process as
-f --frail exit with 1 on warnings
-h --help output usage information
--[no-]ignore search for ignore files (on by default)
-i --ignore-path <path> specify ignore file
--ignore-path-resolve-from cwd|dir resolve patterns in `ignore-path` from its directory or cwd
--ignore-pattern <globs> specify ignore patterns
--inspect output formatted syntax tree
-o --output [path] specify output location
-q --quiet output only warnings and errors
-r --rc-path <path> specify configuration file
--report <reporter> specify reporter
-s --setting <settings> specify settings
-S --silent output only errors
--silently-ignore do not fail when given ignored files
--[no-]stdout specify writing to stdout (on by default)
-t --tree specify input and output as syntax tree
--tree-in specify input as syntax tree
--tree-out output syntax tree
-u --use <plugins> use plugins
--verbose report extra info for messages
-v --version output version number
-w --watch watch for changes and reprocess
Examples:
# Process `input.md`
$ remark input.md -o output.md
# Pipe
$ remark < input.md > output.md
# Rewrite all applicable files
$ remark . -o
More info on all these options is available at unified-args
,
which does the work.
remark-cli
is unified-args
preconfigured to:
remark-
plugins.md
, .markdown
, etc).remarkignore
files.remarkrc
, .remarkrc.js
, etc filesremarkConfig
fields in package.json
filesThis example checks and formats markdown with remark-cli
.
It assumes you’re in a Node.js package.
Install the CLI and plugins:
npm install remark-cli remark-preset-lint-consistent remark-preset-lint-recommended remark-toc --save-dev
…then add an npm script in your package.json
:
/* … */
"scripts": {
/* … */
"format": "remark . --output",
/* … */
},
/* … */
💡 Tip: add ESLint and such in the
format
script too.
The above change adds a format
script, which can be run with
npm run format
.
It runs remark on all markdown files (.
) and rewrites them (--output
).
Run ./node_modules/.bin/remark --help
for more info on the CLI.
Then, add a remarkConfig
to your package.json
to configure remark:
/* … */
"remarkConfig": {
"settings": {
"bullet": "*", // Use `*` for list item bullets (default)
// See <https://github.com/remarkjs/remark/tree/main/packages/remark-stringify> for more options.
},
"plugins": [
"remark-preset-lint-consistent", // Check that markdown is consistent.
"remark-preset-lint-recommended", // Few recommended rules.
[
// Generate a table of contents in `## Contents`
"remark-toc",
{
"heading": "contents"
}
]
]
},
/* … */
👉 Note: you must remove the comments in the above examples when copy/pasting them as comments are not supported in
package.json
files.
Finally, you can run the npm script to check and format markdown files in your project:
npm run format
In the previous example, we saw that remark-cli
was configured from within a
package.json
file.
That’s a good place when the configuration is relatively short, when you have a
package.json
, and when you don’t need comments (which are not allowed in
JSON).
You can also define configuration in separate files in different languages.
With the package.json
config as inspiration, here’s a JavaScript version that
can be placed in .remarkrc.js
:
import remarkPresetLintConsistent from 'remark-preset-lint-consistent'
import remarkPresetLintRecommended from 'remark-preset-lint-recommended'
import remarkToc from 'remark-toc'
const remarkConfig = {
settings: {
bullet: '*', // Use `*` for list item bullets (default)
// See <https://github.com/remarkjs/remark/tree/main/packages/remark-stringify> for more options.
},
plugins: [
remarkPresetLintConsistent, // Check that markdown is consistent.
remarkPresetLintRecommended, // Few recommended rules.
// Generate a table of contents in `## Contents`
[remarkToc, {heading: 'contents'}]
]
}
export default remarkConfig
This is the same configuration in YAML, which can be placed in .remarkrc.yml
:
settings:
bullet: "*"
plugins:
# Check that markdown is consistent.
- remark-preset-lint-consistent
# Few recommended rules.
- remark-preset-lint-recommended
# Generate a table of contents in `## Contents`
- - remark-toc
- heading: contents
When remark-cli
is about to process a markdown file it’ll search the file
system upwards for configuration files starting at the folder where that file
exists.
Take the following file structure as an illustration:
folder/
├─ subfolder/
│ ├─ .remarkrc.json
│ └─ file.md
├─ .remarkrc.js
├─ package.json
└─ readme.md
When folder/subfolder/file.md
is processed, the closest config file is
folder/subfolder/.remarkrc.json
.
For folder/readme.md
, it’s folder/.remarkrc.js
.
The order of precedence is as follows.
Earlier wins (so in the above file structure folder/.remarkrc.js
wins over
folder/package.json
):
.remarkrc
(JSON).remarkrc.cjs
(CJS).remarkrc.js
(CJS or ESM, depending on type: 'module'
in package.json
).remarkrc.json
(JSON).remarkrc.mjs
(ESM).remarkrc.yaml
(YAML).remarkrc.yml
(YAML)package.json
with remarkConfig
fieldProjects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, remark-cli@^12
,
compatible with Node.js 16.
As markdown can be turned into HTML and improper use of HTML can open you up to
cross-site scripting (XSS) attacks, use of remark can be unsafe.
When going to HTML, you will likely combine remark with rehype, in which
case you should use rehype-sanitize
.
Use of remark plugins could also open you up to other attacks. Carefully assess each plugin and the risks involved in using them.
For info on how to submit a report, see our security policy.
See contributing.md
in remarkjs/.github
for ways
to get started.
See support.md
for ways to get help.
Join us in Discussions to chat with the community and contributors.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
Support this effort and give back by sponsoring on OpenCollective!
Vercel |
Motif |
HashiCorp |
GitBook |
Gatsby | ||||
Netlify |
Coinbase |
ThemeIsle |
Expo |
Boost Note |
Markdown Space |
Holloway | ||
You? |
FAQs
CLI to process markdown with remark
The npm package remark-cli receives a total of 185,472 weekly downloads. As such, remark-cli popularity was classified as popular.
We found that remark-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.