
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
csv-stringify
Advanced tools
The csv-stringify package is a stringifier converting records into a CSV text and implementing the Node.js stream.Transform API. It also provides the easier synchronous and callback-based APIs for conveniency. It is both extremely easy to use and powerful. It was first released in 2010 and is tested against big data sets by a large community.
csv-generate, csv-parse and stream-transformRun npm install csv to install the full CSV module or run npm install csv-stringify if you are only interested by the CSV stringifier.
The module is built on the Node.js Stream API. Use the callback and sync APIs for simplicity or the stream based API for scalability.
The API is available in multiple flavors. This example illustrates the sync API.
import { stringify } from "csv-stringify/sync";
import assert from "assert";
const output = stringify([
["1", "2", "3", "4"],
["a", "b", "c", "d"],
]);
assert.equal(output, "1,2,3,4\na,b,c,d\n");
Tests are executed with mocha. To install it, run npm install followed by npm test. It will install mocha and its dependencies in your project "node_modules" directory and run the test suite. The tests run against the CoffeeScript source files.
To generate the JavaScript files, run npm run build.
The test suite is run online with Travis. See the Travis definition file to view the tested Node.js version.
The project is sponsored by Adaltas, an Big Data consulting firm based in Paris, France.
PapaParse is a robust and powerful CSV (character-separated values) parser with a focus on ease of use and performance. It can parse CSV files or strings, convert them to JSON, and provide many advanced features like auto-detection of delimiters. Compared to csv-stringify, PapaParse offers both parsing and stringifying capabilities, whereas csv-stringify is focused only on stringifying.
fast-csv is an npm package that provides parsing and formatting capabilities for CSV data. It is designed to be fast and flexible, allowing for both stream and callback-based APIs. While csv-stringify is specifically for stringifying JavaScript data into CSV format, fast-csv offers both parsing and formatting, making it a more comprehensive solution for working with CSV data.
FAQs
CSV stringifier implementing the Node.js `stream.Transform` API
The npm package csv-stringify receives a total of 4,197,934 weekly downloads. As such, csv-stringify popularity was classified as popular.
We found that csv-stringify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.