Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
remark-smartypants
Advanced tools
The remark-smartypants package is a plugin for the remark markdown processor that automatically converts ASCII punctuation characters into 'smart' typographic punctuation. This includes converting straight quotes to curly quotes, double hyphens to en dashes, triple hyphens to em dashes, and more.
Curly Quotes
This feature converts straight double quotes to curly double quotes. In the example, the straight quotes around 'Hello, world!' are converted to curly quotes.
const remark = require('remark');
const smartypants = require('remark-smartypants');
const markdown = '"Hello, world!"';
const result = remark().use(smartypants).processSync(markdown).toString();
console.log(result); // “Hello, world!”
En Dashes
This feature converts double hyphens to en dashes. In the example, '2010--2020' is converted to '2010–2020'.
const remark = require('remark');
const smartypants = require('remark-smartypants');
const markdown = '2010--2020';
const result = remark().use(smartypants).processSync(markdown).toString();
console.log(result); // 2010–2020
Em Dashes
This feature converts triple hyphens to em dashes. In the example, 'Wait---what?' is converted to 'Wait—what?'.
const remark = require('remark');
const smartypants = require('remark-smartypants');
const markdown = 'Wait---what?';
const result = remark().use(smartypants).processSync(markdown).toString();
console.log(result); // Wait—what?
The typogr package provides similar functionality by improving the typography of text. It converts straight quotes to curly quotes, hyphens to en and em dashes, and more. Unlike remark-smartypants, typogr is not specifically designed for markdown processing but can be used in a broader range of text processing tasks.
The smartypants package is a standalone library that converts ASCII punctuation characters into 'smart' typographic punctuation. It offers similar features to remark-smartypants but is not integrated with the remark ecosystem, making it more suitable for general text processing rather than markdown-specific tasks.
remark plugin to implement SmartyPants. Now with 100% more ESM!
# using npm
npm install remark-smartypants
# using yarn
yarn add remark-smartypants
Example using remark:
import remark from "remark";
import smartypants from "remark-smartypants";
const result = await remark().use(smartypants).process("# <<Hello World!>>");
console.log(String(result));
// # «Hello World!»
I created this plugin because I wanted to add SmartyPants to MDX:
import mdx from "@mdx-js/mdx";
import smartypants from "remark-smartypants";
const result = await mdx("# ---Hello World!---", {
remarkPlugins: [smartypants],
});
Note that angle quotes in the former example (<<...>>
) are probably impossible in MDX because there they are invalid syntax.
This plugin uses retext-smartypants under the hood, so it takes the same options:
const result = await remark()
.use(smartypants, { dashes: "oldschool" })
.process("en dash (--), em dash (---)");
FAQs
remark plugin to implement SmartyPants
We found that remark-smartypants demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.