Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
string_decoder
Advanced tools
The string_decoder npm package is used to decode buffer objects into strings in a manner that preserves encoded multi-byte UTF-8 and UTF-16 characters. It is particularly useful when dealing with streams of data that may contain such characters.
Decoding Buffers to Strings
This feature allows for the conversion of buffer objects into strings, ensuring that multi-byte characters are not improperly split at the end of a buffer.
{"const { StringDecoder } = require('string_decoder'); const decoder = new StringDecoder('utf8'); const buffer = Buffer.from([0xE2, 0x82, 0xAC]); console.log(decoder.write(buffer)); // Outputs: '€'"}
Handling Incomplete Multi-byte Characters
This feature is useful when buffers are received in chunks and multi-byte characters are spread across multiple chunks. The StringDecoder ensures that these characters are not converted until the complete character is received.
{"const { StringDecoder } = require('string_decoder'); const decoder = new StringDecoder('utf8'); const buffers = [Buffer.from([0xE2]), Buffer.from([0x82]), Buffer.from([0xAC])]; let result = ''; buffers.forEach((buffer) => { result += decoder.write(buffer); }); result += decoder.end(); console.log(result); // Outputs: '€'"}
iconv-lite is a pure JavaScript implementation of character encoding conversion. It supports many different encodings and is more versatile than string_decoder, which only supports UTF-8, UTF-16LE/BE, and Base64. However, string_decoder is a built-in module and may be preferred for its simplicity when only these encodings are needed.
The buffer package on npm is a node.js core module for binary data manipulation. It can be used to handle binary data directly, but it does not offer the same convenience functions for decoding multi-byte characters as string_decoder does.
Node-core v8.9.4 string_decoder for userland
npm install --save string_decoder
Node-core string_decoder for userland
This package is a mirror of the string_decoder implementation in Node-core.
Full documentation may be found on the Node.js website.
As of version 1.0.0 string_decoder uses semantic versioning.
Previous version numbers match the versions found in Node core, e.g. 0.10.24 matches Node 0.10.24, likewise 0.11.10 matches Node 0.11.10.
The build/ directory contains a build script that will scrape the source from the nodejs/node repo given a specific Node version.
string_decoder
is maintained by the Streams Working Group, which
oversees the development and maintenance of the Streams API within
Node.js. The responsibilities of the Streams Working Group include:
readable-stream
to be included in Node.js.See readable-stream for more details.
FAQs
The string_decoder module from Node core
The npm package string_decoder receives a total of 109,154,970 weekly downloads. As such, string_decoder popularity was classified as popular.
We found that string_decoder demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.