
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This lib lets you run XPath/XQuery or XQUF on XML files. Uses child processes to support traversing large amounts of content.
npm i xquery-cli -g
You can now use the xq command.
Alternative to installing xq, you can run npx xquery-cli
XPath or XQuery expressions can be piped from another process, loaded from an .xqm file, or in the
--expression (-x) option.
The following input is all equal:
xq --expression "fn:current-date()"
xq -x "fn:current-date()"
xq --module ./examples/simple-example.xqm
Or you pipe it in:
echo "fn:current-date()" | xq
cat ./examples/simple-example.xqm | xq
curl -s https://pastebin.com/raw/53pFDEbk | xq
Any argument that is an option counts as an XML file location for which the expression is evaluated.
xq ./foo.xml -x "()"
xq ./foo.xml ./bar.xml -x "()"
xq ./foo.xml -x "()" ./bar.xml
xq ./*.xml -x "()"
For terminals that don't expand file patterns, or to circumvent a "Too many arguments in command
line" error, use --glob (-g):
xq --glob "./examples/**/*.xml" -x "()"
xq -g "./examples/**/*.xml" -x "()"
If you want to use both pattern expansion and the --glob flag you are a mad lad. It would be
useful to know that you may get duplicate results, and results may be ordered differently.
fontoxpath supports XQuery Update Facility, therefore
xq does too. Simply make your expression updating to use it, and xq will update the affected
files in place -- It's recommended that you do this in version controlled content only. Optionally
combine with the --dry option to not actually make file changes just yet.
xq ./foo.xml -x "replace node /* with <bar />"
When running a query on files you are provisioned with the $document-uri variable. It is set to
the name of the file that that query is evaluated on at the time.
xq ./foo.xml -x "\$document-uri"
On Windows you might not have to escape the $.
By default XQuery returns are logged to STDOUT, and event data is logged to STDERR. Use
--no-stdout (-o) or --no-stderr (-O) if you want.
xq -x "fontoxpath:version()" --no-stderr
You can also control the amount of messages, by picking to limit yourself to rawOutput``verbose,
info, or error and everything "above" it like so:
xq -x "fontoxpath:version()" --log-level verbose
This tool relies on the excellent fontoxpath, slimdom and saxes.
FAQs
A command-line tool for XQuery
The npm package xquery-cli receives a total of 157 weekly downloads. As such, xquery-cli popularity was classified as not popular.
We found that xquery-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.