Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The 'tosource' npm package is used to convert JavaScript objects into their source code representation. This can be useful for debugging, serialization, or simply understanding the structure of complex objects.
Convert Object to Source Code
This feature allows you to convert a JavaScript object into its source code representation. The code sample demonstrates converting a nested object into a string of its source code.
const tosource = require('tosource');
const obj = { a: 1, b: [2, 3], c: { d: 4 } };
const source = tosource(obj);
console.log(source);
Handle Functions and RegExp
This feature allows you to convert objects that contain functions and regular expressions into their source code representation. The code sample demonstrates converting an object with a function and a RegExp.
const tosource = require('tosource');
const obj = { a: function() { return 1; }, b: /test/i };
const source = tosource(obj);
console.log(source);
Circular References
This feature allows you to handle circular references within objects. The code sample demonstrates converting an object with a circular reference.
const tosource = require('tosource');
const obj = { a: 1 };
obj.b = obj;
const source = tosource(obj);
console.log(source);
The 'json-stringify-safe' package is used to safely stringify objects with circular references. Unlike 'tosource', it does not convert objects to their source code representation but ensures that JSON.stringify does not throw an error when encountering circular references.
The 'util' package in Node.js provides a 'util.inspect' function that can be used to convert objects to a string representation. While it does not produce source code, it is useful for debugging and logging complex objects.
The 'circular-json' package is another option for serializing objects with circular references. It converts objects to a JSON format that can be parsed back into the original object, but it does not provide a source code representation like 'tosource'.
toSource is a super simple function that converts JavaScript objects back to source code.
Motivation: JSON doesn't support serializing functions, dates, or regular expressions. I wanted a quick and simple way to push trusted data structures with code from Node down to the browser.
This should make it easier to share code and modules between the server and client.
npm install tosource
The following code:
import toSource from 'tosource';
console.log(
toSource([
4,
5,
6,
'hello',
{
a: 2,
b: 3,
'1': 4,
if: 5,
yes: true,
no: false,
nan: NaN,
infinity: Infinity,
undefined: undefined,
null: null,
foo: function (bar) {
console.log('woo! a is ' + a);
console.log('and bar is ' + bar);
},
},
/we$/gi,
new Date('Wed, 09 Aug 1995 00:00:00 GMT'),
]),
);
Output:
[ 4,
5,
6,
"hello",
{ 1:4,
a:2,
b:3,
"if":5,
yes:true,
no:false,
nan:NaN,
infinity:Infinity,
"undefined":undefined,
"null":null,
foo:function (bar) {
console.log('woo! a is ' + a);
console.log('and bar is ' + bar);
} },
/we$/gi,
new Date(807926400000) ]
See tosource.test.ts for more examples.
NaN
, Infinity
, and -0
)RegExp
instancesDate
instancesMap
Set
true
/ false
undefined
null
func.toString()
, no closure properties are serialized{$circularReference:true}
toSource is open source software under the zlib license.
FAQs
toSource converts JavaScript objects back to source
The npm package tosource receives a total of 318,850 weekly downloads. As such, tosource popularity was classified as popular.
We found that tosource demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.