
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A mature CSV toolset with simple api, full of options and tested against large datasets.
The csv project provides CSV generation, parsing, transformation and serialization for Node.js.
It has been tested and used by a large community over the years and should be considered reliable. It provides every option you would expect from an advanced CSV parser and stringifier.
This package exposes 4 packages:
csv-generate
(GitHub),
a flexible generator of CSV string and Javascript objects.csv-parse
(GitHub),
a parser converting CSV text into arrays or objects.csv-stringify
(GitHub),
a stringifier converting records into a CSV text.stream-transform
(GitHub),
a transformation framework.The full documentation for the current version is available here.
Installation command is npm install csv.
Each package is fully compatible with the Node.js stream 2 and 3 specifications. Also, a simple callback-based API is always provided for convenience.
// Import the package
import * as csv from "csv/sync";
// Run the pipeline
import { generate, parse, transform, stringify } from "csv/sync";
// Run the pipeline
const input = generate({ seed: 1, columns: 2, length: 2 });
const rawRecords = parse(input);
const refinedRecords = transform(rawRecords, (data) =>
data.map((value) => value.toUpperCase()),
);
const output = stringify(refinedRecords);
// Print the final result
console.log(output);
//> OMH,ONKCHHJMJADOA
//> D,GEACHIN
This example uses the Stream API to create a processing pipeline.
// Import the package
import * as csv from "csv";
// Run the pipeline
csv
// Generate 20 records
.generate({
delimiter: "|",
length: 20,
})
// Transform CSV data into records
.pipe(
csv.parse({
delimiter: "|",
}),
)
// Transform each value into uppercase
.pipe(
csv.transform((record) => {
return record.map((value) => {
return value.toUpperCase();
});
}),
)
// Convert objects into a stream
.pipe(
csv.stringify({
quoted: true,
}),
)
// Print the CSV stream to stdout
.pipe(process.stdout);
This parent project doesn't have tests itself but instead delegates the tests to its child projects.
Read the documentation of the child projects for additional information.
The project is sponsored by Adaltas, an Big Data consulting firm based in Paris, France.
PapaParse is a robust and powerful CSV parser for JavaScript with a similar feature set to csv. It supports browser and server-side parsing, auto-detection of delimiters, and streaming large files. Compared to csv, PapaParse is known for its ease of use and strong browser-side capabilities.
fast-csv is another popular CSV parsing and formatting library for Node.js. It offers a simple API, flexible parsing options, and support for streams. While csv provides a comprehensive set of tools for various CSV operations, fast-csv focuses on performance and ease of use for common tasks.
FAQs
A mature CSV toolset with simple api, full of options and tested against large datasets.
The npm package csv receives a total of 1,220,768 weekly downloads. As such, csv popularity was classified as popular.
We found that csv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.