Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
xast-util-feed
Advanced tools
xast utility to build (web) feeds (RSS, Atom).
This package generates RSS or Atom feeds from data.
This package helps you add feeds to your site. It focusses on a small set of widely used and supported parts of feeds. It has a few good options instead of overwhelming with hundreds of things to configure. If you do need more things, well: this utility gives you a syntax tree, which you can change.
It’s good to use this package to build several feeds and to only include recent posts (often 15-20 items are included in a channel). You should make a channel for all your posts; when relevant, separate channels per language as well; and potentially, channels per post type (such as separate ones for blog posts, notes, and images).
Just using either RSS or Atom is probably fine: no need to do both.
This package is ESM only. In Node.js (version 12.20+, 14.14+, 16.0+, or 18.0+), install with npm:
npm install xast-util-feed
In Deno with esm.sh
:
import {atom, rss} from 'https://esm.sh/xast-util-feed@1'
In browsers with esm.sh
:
<script type="module">
import {atom, rss} from 'https://esm.sh/xast-util-feed@1?bundle'
</script>
import {atom, rss} from 'xast-util-feed'
import {toXml} from 'xast-util-to-xml'
const channel = {
title: 'NYT > Top Stories',
url: 'https://www.nytimes.com',
feedUrl: 'https://rss.nytimes.com/services/xml/rss/nyt/HomePage.xml',
lang: 'en',
author: 'The New York Times Company'
}
const data = [
{
title: 'Senate Balances Impeachment Trial With an Incoming President',
url:
'https://www.nytimes.com/2021/01/14/us/politics/impeachment-senate-trial-trump.html',
descriptionHtml: '<p>Senate leaders etc etc etc.</p>',
author: 'Nicholas Fandos and Catie Edmondson',
published: 'Fri, 15 Jan 2021 01:18:49 +0000',
tags: ['Senate', 'Murkowski, Lisa', 'Trump, Donald J']
}
]
console.log(toXml(rss(channel, data)))
console.log(toXml(atom(channel, data)))
Yields (pretty printed):
<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
<title>NYT > Top Stories</title>
<description></description>
<link>https://www.nytimes.com/</link>
<lastBuildDate>Sun, 17 Jan 2021 09:00:54 GMT</lastBuildDate>
<dc:date>2021-01-17T09:00:54.781Z</dc:date>
<atom:link href="https://rss.nytimes.com/services/xml/rss/nyt/HomePage.xml" rel="self" type="application/rss+xml"></atom:link>
<language>en</language>
<dc:language>en</dc:language>
<copyright>© 2021 The New York Times Company</copyright>
<dc:rights>© 2021 The New York Times Company</dc:rights>
<item>
<title>Senate Balances Impeachment Trial With an Incoming President</title>
<dc:creator>Nicholas Fandos and Catie Edmondson</dc:creator>
<link>https://www.nytimes.com/2021/01/14/us/politics/impeachment-senate-trial-trump.html</link>
<guid isPermaLink="false">https://www.nytimes.com/2021/01/14/us/politics/impeachment-senate-trial-trump.html</guid>
<pubDate>Fri, 15 Jan 2021 01:18:49 GMT</pubDate>
<dc:date>2021-01-15T01:18:49.000Z</dc:date>
<category>Senate</category>
<category>Murkowski, Lisa</category>
<category>Trump, Donald J</category>
<description><p>Senate leaders etc etc etc.</p></description>
</item>
</channel>
</rss>
<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
<title>NYT > Top Stories</title>
<subtitle></subtitle>
<link>https://www.nytimes.com/</link>
<id>https://www.nytimes.com/</id>
<updated>Sun, 17 Jan 2021 09:00:54 GMT</updated>
<link href="https://rss.nytimes.com/services/xml/rss/nyt/HomePage.xml" rel="self" type="application/atom+xml"></link>
<rights>© 2021 The New York Times Company</rights>
<author>
<name>The New York Times Company</name>
</author>
<category term="Senate"></category>
<category term="Murkowski, Lisa"></category>
<category term="Trump, Donald J"></category>
<entry>
<title>Senate Balances Impeachment Trial With an Incoming President</title>
<author>
<name>Nicholas Fandos and Catie Edmondson</name>
</author>
<link href="https://www.nytimes.com/2021/01/14/us/politics/impeachment-senate-trial-trump.html"></link>
<id>https://www.nytimes.com/2021/01/14/us/politics/impeachment-senate-trial-trump.html</id>
<published>2021-01-15T01:18:49.000Z</published>
<content type="html"><p>Senate leaders etc etc etc.</p></content>
</entry>
</feed>
This package exports the identifiers atom
and rss
.
There is no default export.
rss(channel, data)
Build an RSS feed.
channel
See Channel
.
data
List of Entry
objects.
atom(channel, data)
Build an Atom feed.
Same API as rss
otherwise.
Channel
Data on the feed (the group of items).
channel.title
Title of the channel (string
, required, example: Zimbabwe | The Guardian
).
channel.url
Full URL to the site (string
, required, example:
'https://www.theguardian.com/world/zimbabwe'
).
channel.feedUrl
Full URL to this channel (string?
, example: 'https://www.adweek.com/feed/'
).
Make sure to pass different ones to rss
and atom
when you build both!
You should define this.
channel.description
Short description of the channel (string?
, example: Album Reviews
).
You should define this.
channel.lang
BCP 47 language tag representing the language of the whole channel
(string?
, example: 'fr-BE'
).
You should define this.
channel.author
Optional author of the whole channel.
Either string
, in which case it’s as passing {name: string}
.
Or an object with the following fields:
name
(string
, example: 'Acme, Inc.'
or 'Jane Doe'
)email
(string?
, example: john@example.org
)url
(string?
, example: 'https://example.org/john'
)url
is used in atom
, not in rss
.
channel.tags
Categories of the channel (Array<string>?
, example: ['JavaScript', 'React']
).
Entry
Data on a single item.
entry.title
Title of the item (string?
, example: 'Playboi Carti: Whole Lotta Red'
).
Either title
, description
, or descriptionHtml
must be set.
entry.description
Either the whole post or an excerpt of it (string?
, example: 'Lorem'
).
Should be plain text.
descriptionHtml
is preferred over plain text description
.
Either title
, description
, or descriptionHtml
must be set.
entry.descriptionHtml
Either the whole post or an excerpt of it (string?
, example: '<p>Lorem</p>'
).
Should be serialized HTML.
descriptionHtml
is preferred over plain text description
.
Either title
, description
, or descriptionHtml
must be set.
entry.author
Entry version of channel.author
.
You should define this.
For atom
, it is required to either set channel.author
or set author
on all
entries.
entry.url
Full URL of this entry on the site (string?
, example:
'https://pitchfork.com/reviews/albums/roberta-flack-first-take'
).
entry.published
When the entry was first published (Date
or value for new Date(x)
,
optional).
entry.modified
When the entry was last modified (Date
or value for new Date(x)
, optional).
entry.tags
Categories of the entry (Array<string>?
, example: ['laravel', 'debugging']
).
entry.enclosure
An enclosure, such as an image or audio, is an object with the following fields:
url
(string
, example: 'http://dallas.example.com/joebob_050689.mp3'
)
— full URL to the resourcesize
(number
, example: 24986239
)
— resource size in bytestype
(string
, example: 'audio/mpeg'
)
— mime type of the resourceThis package is fully typed with TypeScript.
It exports the additional types Author
, Enclosure
, Channel
, and Entry
.
Projects maintained by the unified collective are compatible with all maintained versions of Node.js. As of now, that is Node.js 12.20+, 14.14+, 16.0+, and 18.0+. Our projects sometimes work with older versions, but this is not guaranteed.
XML can be a dangerous language: don’t trust user-provided data.
xast-util-to-xml
— serialize xast to XMLxast-util-sitemap
— build a sitemapxastscript
— create xast treesSee contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
xast utility to build feeds (rss, atom)
We found that xast-util-feed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.