
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
whatwg-url
Advanced tools
An implementation of the WHATWG URL Standard's URL API and parsing machinery
whatwg-url is a full implementation of the WHATWG URL Standard. It can be used standalone, but it also exposes a lot of the internal algorithms that are useful for integrating a URL parser into a project like jsdom.
whatwg-url is currently up to date with the URL spec up to commit 9dc3827.
For file: URLs, whose origin is left unspecified, whatwg-url chooses to use a new opaque origin (which serializes to "null").
URL and URLSearchParams classesThe main API is provided by the URL and URLSearchParams exports, which follows the spec's behavior in all ways (including e.g. USVString conversion). Most consumers of this library will want to use these.
The following methods are exported for use by places like jsdom that need to implement things like HTMLHyperlinkElementUtils. They mostly operate on or return an "internal URL" or "URL record" type.
parseURL(input, { baseURL, encoding = "UTF-8" })parseURLWithValidationErrors(input, { baseURL, encoding = "UTF-8" })isValidURLString(input, { baseURL })basicURLParse(input, { baseURL, url, stateOverride, encoding = "UTF-8" })serializeURL(urlRecord, excludeFragment)serializeHost(hostFromURLRecord)serializePath(urlRecord)serializeInteger(number)serializeURLOrigin(urlRecord)setTheUsername(urlRecord, usernameString)setThePassword(urlRecord, passwordString)hasAnOpaquePath(urlRecord)cannotHaveAUsernamePasswordPort(urlRecord)percentDecodeBytes(uint8Array)percentDecodeString(string)The stateOverride parameter is one of the following strings:
"scheme start""scheme""no scheme""special relative or authority""path or authority""relative""relative slash""special authority slashes""special authority ignore slashes""authority""host""hostname""port""file""file slash""file host""path start""path""opaque path""query""fragment"The URL record type has the following API:
These properties should be treated with care, as in general changing them will cause the URL record to be in an inconsistent state until the appropriate invocation of basicURLParse is used to fix it up. You can see examples of this in the URL Standard, where there are many step sequences like "4. Set context object’s url’s fragment to the empty string. 5. Basic URL parse input with context object’s url as url and fragment state as state override." In between those two steps, a URL record is in an unusable state.
The return value of "failure" in the spec is represented by null. That is, functions like parseURL and basicURLParse can return either a URL record or null.
The parseURLWithValidationErrors function returns an object with a url property and a validationErrors property. The url property is a URL record or null, and the validationErrors property is an array of validation error names reported while parsing.
const result = parseURLWithValidationErrors("https://example.org/%s");
console.log(result.url === null); // false
console.log(result.validationErrors); // [ "invalid-URL-unit" ]
The isValidURLString function implements the grammar-based validity checker from the URL Standard's URL writing section. This is separate from parser validation errors, so it can disagree with parseURLWithValidationErrors() in some cases. Pass a baseURL URL record to check relative-URL strings.
whatwg-url/webidl2js-wrapper moduleThis module exports the URL and URLSearchParams interface wrappers API generated by webidl2js.
First, install Node.js. Then, fetch the dependencies of whatwg-url, by running from this directory:
npm install
To run tests:
npm test
To generate a coverage report:
npm run coverage
To build and run the live viewer:
npm run prepare
npm run build-live-viewer
Serve the contents of the live-viewer directory using any web server.
The jsdom project (including whatwg-url) is a community-driven project maintained by a team of volunteers. You could support us by:
url-parse is a package that offers URL parsing and manipulation. It provides a similar API to whatwg-url but also works in environments without the native URL constructor. It can be a lighter alternative with similar capabilities.
urijs is a URL manipulation library that allows parsing, building, and normalizing URLs. It offers a fluent API and additional features like URI building and resolution, which makes it more feature-rich compared to whatwg-url.
FAQs
An implementation of the WHATWG URL Standard's URL API and parsing machinery
The npm package whatwg-url receives a total of 134,606,218 weekly downloads. As such, whatwg-url popularity was classified as popular.
We found that whatwg-url demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.