Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
string.prototype.matchall
Advanced tools
The string.prototype.matchall npm package is a polyfill for the `String.prototype.matchAll` method, which returns an iterator of all results matching a string against a regular expression, including capturing groups. This package is particularly useful for environments that do not yet support the `matchAll` method natively.
Matching all occurrences of a pattern
This feature allows you to find all occurrences of the pattern `/test/g` in the string `"test1test2"`. It returns an iterator that contains all matches.
"test1test2".matchAll(/test/g)
Capturing groups in matches
This demonstrates how to use capturing groups with `matchAll`. The regular expression `/(te)(st\d)/g` includes two capturing groups that match parts of the string. The result is an iterator of matches, where each match includes the full matched text and the text matched by each capturing group.
"test1test2".matchAll(/(te)(st\d)/g)
XRegExp provides augmented, extensible regular expressions. You can use it for more complex matching and replacing operations than what's possible with native JavaScript RegExp. It includes support for additional syntax and flags. While it offers more features overall, it doesn't specifically focus on the `matchAll` functionality but can achieve similar results with its APIs.
This package offers a polyfill for the `RegExp.prototype.exec` method to include match indices in the result objects. It's similar to `string.prototype.matchall` in that it enhances the capabilities of regular expressions in JavaScript, but it focuses on providing match position information rather than iterating over all matches.
ES2020 spec-compliant shim for String.prototype.matchAll. Invoke its "shim" method to shim String.prototype.matchAll
if it is unavailable or noncompliant.
This package implements the es-shim API interface. It works in an ES3-supported environment, and complies with the spec.
Most common usage:
const assert = require('assert');
const matchAll = require('string.prototype.matchall');
const str = 'aabc';
const nonRegexStr = 'ab';
const globalRegex = /[ac]/g;
const nonGlobalRegex = /[bc]/i;
// non-regex arguments are coerced into a global regex
assert.deepEqual(
[...matchAll(str, nonRegexStr)],
[...matchAll(str, new RegExp(nonRegexStr, 'g'))]
);
assert.deepEqual([...matchAll(str, globalRegex)], [
Object.assign(['a'], { index: 0, input: str, groups: undefined }),
Object.assign(['a'], { index: 1, input: str, groups: undefined }),
Object.assign(['c'], { index: 3, input: str, groups: undefined }),
]);
assert.throws(() => matchAll(str, nonGlobalRegex)); // non-global regexes throw
matchAll.shim(); // will be a no-op if not needed
// non-regex arguments are coerced into a global regex
assert.deepEqual(
[...str.matchAll(nonRegexStr)],
[...str.matchAll(new RegExp(nonRegexStr, 'g'))]
);
assert.deepEqual([...str.matchAll(globalRegex)], [
Object.assign(['a'], { index: 0, input: str, groups: undefined }),
Object.assign(['a'], { index: 1, input: str, groups: undefined }),
Object.assign(['c'], { index: 3, input: str, groups: undefined }),
]);
assert.throws(() => matchAll(str, nonGlobalRegex)); // non-global regexes throw
Simply clone the repo, npm install
, and run npm test
v4.0.11 - 2024-03-19
call-bind
, define-properties
, es-abstract
, get-intrinsic
, internal-slot
, regexp.prototype.flags
, set-function-name
, side-channel
628a475
aud
, mock-property
, npmignore
, object-inspect
, object.assign
, object.entries
, tape
21b67f2
27e8b80
92e9c59
es-errors
f6de643
gopd
965a357
es-object-atoms
where possible 1d15123
engines.node
04bdb31
FAQs
Spec-compliant polyfill for String.prototype.matchAll
The npm package string.prototype.matchall receives a total of 15,577,335 weekly downloads. As such, string.prototype.matchall popularity was classified as popular.
We found that string.prototype.matchall demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.