
Research
Security News
The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
stream-replace-string
Advanced tools
Replaces strings in a stream.
npm i stream-replace-string
import replace from 'stream-replace-string'
import { createReadStream, createWriteStream } from 'fs'
createReadStream("./input.txt")
.pipe(replace("{fruit}", "apple"))
.pipe(createWriteStream("./output.txt"))
You can also replace multiple different words by piping your data through multiple replace streams
createReadStream("./input.txt")
.pipe(replace("good", "great"))
.pipe(replace("bad", "horrible"))
.pipe(replace("grey", "gray"))
.pipe(createWriteStream("./output.txt"))
replace
functionreplace(searchStr, replaceWith, options)
searchStr
- The string to search for. This must be a string, and cannot be a regex.replaceWith
- There are a couple of different things you can use:
matches
, which is the number of matches so far (for the first match, this will be 0
). This function should return a string or a promise resolving a string.options.bufferReplaceStream
for options if you are using a readable stream.options
(optional) - An object of options.
limit
(optional, default Infinity
) - The maximum number of strings to replace. This can be useful if you know there is only 1 occurrence of searchStr
. Once this limit is reached, the transform stream will stop transforming anything.bufferReplaceStream
(optional, default true
) - This is for when you use a readable stream for replaceWith
. If this is true, the replaceWith
stream will be read right away, and be kept in memory to be used once a match is found. For fastest performance, keep this to be true
. If your replaceWith
stream is very large and you have a limit of 1, you can set this to false
to save memory.The replace
function returns a Node.js transform stream. Transform streams take in chunks and can also be read. In this particular transform stream, it takes a string and outputs the same string, except that it replaces the replace.
The tricky part with this transform stream is knowing when to hold chunks, and when to pass them on. Let's say we were looking for 'paper'
in our text. If our first chunk was: 'perfect pot'
, this module knows that there is no way the string 'perfect pot'
will fit into the search string, 'paper'
. We can then pass the chunks onto the output of the transform stream, available right away for the stream consumer. However, if our first chunk was: 'p'
, we can't pass that on, because there is a change that the next chunk could start with 'aper'
. Since we aren't sure if the 'p'
will be replaced or not, we hold on to this text, and check it once we get the next chunk. If we get 'aper'
in the next chunk, we replace the text. If we get something else, like 'ear'
, we can attach it to the 'p'
and output 'pear'
. It gets even more complicated when multiple potential matches are possible. Let's say we get 'pap'
in our first chunk. We need to be watching the first 'p'
and the third 'p'
, because it could end up being 'paper'
, if the next chunk was 'er'
, or it could end of being 'papaper'
. This package is smart and it will efficiently find matches spanning multiple chunks, and get rid of text it knows won't have a match.
import replace from 'stream-replace-string'
FAQs
Replaces strings in a stream.
The npm package stream-replace-string receives a total of 0 weekly downloads. As such, stream-replace-string popularity was classified as not popular.
We found that stream-replace-string demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
Security News
ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.