
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A URL manipulation library that offers support for daisy chaining, pathname resolution and query args manipulation.
A daisy-chaining URL manipulation library. As of v4.0.0, the library has been ported to TypeScript.
Modern versions of Node.js ship with a native implementation of the
WHATWG URL interface in the form of the URL class exported by the
url module.
yurl builds upon such interface by implementing dedicated modifier methods
for each URL property, adding a few bits of useful logic here and there.
import { YURL } from 'yurl';
new YURL('http://example.com/foo/bar?a=24')
.pathname('..', 'baz') // Resolves pathname to /foo/baz
.port(8888) // Changes port to 8888
.query({a: null, b: 24}) // Drops param "a", sets param "b"
.format() // Serialization
// ==> http://example.com:8888/foo/baz?b=24
npm install yurl
import { YURL } from 'yurl';
const { YURL } = require('yurl');
The backing instance of the URL class is available through the parts property.
const example = new YURL('http://example.com');
example.parts.hostname === 'example.com'; // true
example.parts.protocol === 'http:'; // true
The clone() method returns a deep copy of the current YURL instance. All other methods are modifier methods and alter the instance they are called upon.
The pathname() method supports trailing slashes and both absolute and relative pathnames.
const example = new YURL('http://example.com');
example.parts.pathname === '/'; // true
example.pathname('/foo/bar');
example.parts.pathname === '/foo/bar'; // true
example.pathname('../baz');
example.parts.pathname === '/baz'; // true
example.pathname('/baz/');
example.parts.pathname === '/baz/'; // true
Query params are set and removed via the .query() method.
const example = new YURL('http://example.com');
example.query('answer', '42');
example.parts.query.answer[0] === '42'; // true
example.format(); // ?answer=42
example.query({answer: null, hello: 'world'});
example.parts.query.answer; // undefined
example.parts.query.hello[0] === 'world'; // true
example.format(); // ?hello=world
example.query('pets', ['cats', 'dogs']);
example.parts.query.pets[0] === 'cats'; // true
example.parts.query.pets[1] === 'dogs'; // true
example.format(); // ?pets=cats&pets=dogs
example.query(); // removes all params
npm test
MIT
FAQs
A URL manipulation library that offers support for daisy chaining, pathname resolution and query args manipulation.
The npm package yurl receives a total of 1 weekly downloads. As such, yurl popularity was classified as not popular.
We found that yurl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.