Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
The sprintf-js package is a JavaScript implementation of the sprintf function, which is originally from the C programming language. It provides string formatting capabilities, allowing users to format strings with placeholders that are replaced by specified values in a controlled manner.
sprintf
The sprintf function allows you to format a string with placeholders, such as %s for strings, %d for integers, and many others. The placeholders are replaced by the provided arguments in order.
const sprintf = require('sprintf-js').sprintf;
const formattedString = sprintf('Hello, %s!', 'World');
vsprintf
The vsprintf function is similar to sprintf but takes an array of arguments instead of a variable number of arguments, which can be useful when the number of values to substitute is dynamic or not known in advance.
const vsprintf = require('sprintf-js').vsprintf;
const formattedString = vsprintf('There are %d %s', [3, 'apples']);
The util package is a core Node.js module that includes a format method similar to sprintf. It is less feature-rich compared to sprintf-js and does not support all the placeholder types that sprintf-js does.
The printf package offers similar functionality to sprintf-js with a focus on being lightweight. It provides a subset of the formatting options available in sprintf-js and is designed to be a minimalistic alternative.
sprintf.js is a complete open source JavaScript sprintf implementation for the browser and node.js.
Its prototype is simple:
string sprintf(string format , [mixed arg1 [, mixed arg2 [ ,...]]])
The placeholders in the format string are marked by %
and are followed by one or more of these elements, in this order:
$
sign that selects which argument index to use for the value. If not specified, arguments will be placed in the same order as the placeholders in the input string.+
sign that forces to preceed the result with a plus or minus sign on numeric values. By default, only the -
sign is used on negative numbers.0
or any other character precedeed by a '
(single quote). The default is to pad with spaces.-
sign, that causes sprintf to left-align the result of this placeholder. The default is to right-align the result..
(dot) followed by a number, that says how many digits should be displayed for floating point numbers. When used on a string, it causes the result to be truncated.%
— yields a literal %
characterb
— yields an integer as a binary numberc
— yields an integer as the character with that ASCII valued
or i
— yields an integer as a signed decimal numbere
— yields a float using scientific notationu
— yields an integer as an unsigned decimal numberf
— yields a float as iso
— yields an integer as an octal numbers
— yields a string as isx
— yields an integer as a hexadecimal number (lower-case)X
— yields an integer as a hexadecimal number (upper-case)vsprintf
vsprintf
is the same as sprintf
except that it accepts an array of arguments, rather than a variable number of arguments:
vsprintf("The first 4 letters of the english alphabet are: %s, %s, %s and %s", ["a", "b", "c", "d"])
You can also swap the arguments. That is, the order of the placeholders doesn't have to match the order of the arguments. You can do that by simply indicating in the format string which arguments the placeholders refer to:
sprintf("%2$s %3$s a %1$s", "cracker", "Polly", "wants")
And, of course, you can repeat the placeholders without having to increase the number of arguments.
Format strings may contain replacement fields rather than positional placeholders. Instead of referring to a certain argument, you can now refer to a certain key within an object. Replacement fields are surrounded by rounded parentheses - (
and )
- and begin with a keyword that refers to a key:
var user = {
name: "Dolly"
}
sprintf("Hello %(name)s", user) // Hello Dolly
Keywords in replacement fields can be optionally followed by any number of keywords or indexes:
var users = [
{name: "Dolly"},
{name: "Molly"},
{name: "Polly"}
]
sprintf("Hello %(users[0].name)s, %(users[1].name)s and %(users[2].name)s", {users: users}) // Hello Dolly, Molly and Polly
Note: mixing positional and named placeholders is not (yet) supported
You can pass in a function as a dynamic value and it will be invoked (with no arguments) in order to compute the value on-the-fly.
sprintf("Current timestamp: %d", Date.now) // Current timestamp: 1398005382890
sprintf("Current date and time: %s", function() { return new Date().toString() })
You can now use sprintf
and vsprintf
(also aliased as fmt
and vfmt
respectively) in your AngularJS projects. See demo/
.
bower install sprintf
npm install sprintf-js
var sprintf = require("sprintf-js").sprintf,
vsprintf = require("sprintf-js").vsprintf
sprintf("%2$s %3$s a %1$s", "cracker", "Polly", "wants")
vsprintf("The first 4 letters of the english alphabet are: %s, %s, %s and %s", ["a", "b", "c", "d"])
FAQs
JavaScript sprintf implementation
The npm package sprintf-js receives a total of 50,931,120 weekly downloads. As such, sprintf-js popularity was classified as popular.
We found that sprintf-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.