Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
vfile-reporter
Advanced tools
The vfile-reporter package is used to format and report messages from vfile objects, which are used to represent files with associated metadata and messages. It is particularly useful in the context of processing files with tools like unified, remark, and rehype.
Basic Reporting
This feature allows you to generate a basic report from a vfile object. The report includes messages such as warnings or errors associated with the file.
const vfile = require('vfile');
const vfileReporter = require('vfile-reporter');
const file = vfile({path: 'example.md', contents: 'Hello, world!'});
file.message('Warning: something is not right', {line: 1, column: 1});
console.log(vfileReporter([file]));
Custom Reporters
This feature allows you to create custom reporters to format the messages in a way that suits your needs. The example shows a custom reporter that formats messages with file path, line, and column information.
const vfile = require('vfile');
const vfileReporter = require('vfile-reporter');
const file = vfile({path: 'example.md', contents: 'Hello, world!'});
file.message('Warning: something is not right', {line: 1, column: 1});
const customReporter = (files) => {
return files.map(file => file.messages.map(msg => `${file.path}:${msg.line}:${msg.column} - ${msg.reason}`).join('\n')).join('\n');
};
console.log(customReporter([file]));
ESLint is a tool for identifying and reporting on patterns found in ECMAScript/JavaScript code. It is highly configurable and can be extended with custom rules and plugins. Unlike vfile-reporter, which is more general-purpose and can be used with any type of file, ESLint is specifically designed for JavaScript and TypeScript code.
Stylelint is a linter that helps you avoid errors and enforce conventions in your styles. It is specifically designed for CSS and other style languages. Similar to vfile-reporter, it provides detailed reports of issues found in the files it processes, but it is specialized for style sheets.
Markdownlint is a linter for Markdown files. It helps enforce standards and catch common mistakes in Markdown documents. While vfile-reporter can be used with Markdown files as part of a larger toolchain, markdownlint is specifically focused on Markdown and provides a set of rules tailored to that format.
vfile utility to create a report.
This package create a textual report from files showing the warnings that occurred while processing. Many CLIs of tools that process files, whether linters (such as ESLint) or bundlers (such as esbuild), have similar functionality.
You can use this package when you want to display a report about what occurred while processing to a human.
There are other reporters that display information differently listed in vfile.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install vfile-reporter
In Deno with esm.sh
:
import {reporter} from 'https://esm.sh/vfile-reporter@8'
In browsers with esm.sh
:
<script type="module">
import {reporter} from 'https://esm.sh/vfile-reporter@8?bundle'
</script>
Say our module example.js
looks as follows:
import {VFile} from 'vfile'
import {reporter} from 'vfile-reporter'
const one = new VFile({path: 'test/fixture/1.js'})
const two = new VFile({path: 'test/fixture/2.js'})
one.message('Warning!', {line: 2, column: 4})
console.error(reporter([one, two]))
…now running node example.js
yields:
test/fixture/1.js
2:4 warning Warning!
test/fixture/2.js: no issues found
⚠ 1 warning
This package exports the identifier reporter
.
That value is also the default
export.
reporter(files[, options])
Create a report from one or more files.
files
(Array<VFile>
or VFile
)
— files to reportoptions
(Options
, optional)
— configurationReport (string
).
Options
Configuration (TypeScript type).
color
(boolean
, default: true
when in Node.js and
color is supported, or false
)
— use ANSI colors in reportdefaultName
(string
, default: '<stdin>'
)
— Label to use for files without file path; if one file and no defaultName
is given, no name will show up in the reportverbose
(boolean
, default: false
)
— show message notes, URLs, and ancestor stack trace if availablequiet
(boolean
, default: false
)
— do not show files without messagessilent
(boolean
, default: false
)
— show errors only; this hides info and warning messages, and sets
quiet: true
traceLimit
(number
, default: 10
)
— max number of nodes to show in ancestors trace); ancestors can be shown
when verbose: true
Here’s a small example that looks through a markdown AST for emphasis and
strong nodes, and checks whether they use *
.
The message has detailed information which will be shown in verbose mode.
example.js
:
import {fromMarkdown} from 'mdast-util-from-markdown'
import {visitParents} from 'unist-util-visit-parents'
import {VFile} from 'vfile'
import {reporter} from 'vfile-reporter'
const file = new VFile({
path: new URL('example.md', import.meta.url),
value: '# *hi*, _world_!'
})
const value = String(file)
const tree = fromMarkdown(value)
visitParents(tree, (node, parents) => {
if (node.type === 'emphasis' || node.type === 'strong') {
const start = node.position?.start.offset
if (start !== undefined && value.charAt(start) === '_') {
const m = file.message('Expected `*` (asterisk), not `_` (underscore)', {
ancestors: [...parents, node],
place: node.position,
ruleId: 'attention-marker',
source: 'some-lint-example'
})
m.note = `It is recommended to use asterisks for emphasis/strong attention when
writing markdown.
There are some small differences in whether sequences can open and/or close…`
m.url = 'https://example.com/whatever'
}
}
})
console.error(reporter([file], {verbose: false}))
…running node example.js
yields:
/Users/tilde/Projects/oss/vfile-reporter/example.md
1:9-1:16 warning Expected `*` (asterisk), not `_` (underscore) attention-marker some-lint-example
⚠ 1 warning
To show the info, pass verbose: true
to reporter
, and run again:
and see:
/Users/tilde/Projects/oss/vfile-reporter/example.md
1:9-1:16 warning Expected `*` (asterisk), not `_` (underscore) attention-marker some-lint-example
[url]:
https://example.com/whatever
[note]:
It is recommended to use asterisks for emphasis/strong attention when
writing markdown.
There are some small differences in whether sequences can open and/or close…
[trace]:
at emphasis (1:9-1:16)
at heading (1:1-1:17)
at root (1:1-1:17)
⚠ 1 warning
This package is fully typed with TypeScript.
It exports the additional type Options
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, vfile-reporter@^8
,
compatible with Node.js 16.
Use of vfile-reporter
is safe.
vfile-reporter-json
— create a JSON reportvfile-reporter-pretty
— create a pretty reportvfile-reporter-junit
— create a jUnit reportvfile-reporter-position
— create a report with content excerptsSee contributing.md
in vfile/.github
for ways to
get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.
FAQs
vfile utility to create a report for a file
The npm package vfile-reporter receives a total of 241,559 weekly downloads. As such, vfile-reporter popularity was classified as popular.
We found that vfile-reporter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.