
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
data-document-creator
Advanced tools
This package can be used to generate JSON and XML documents.
A document is generated with the help of a document description.
document descriptionA document description is a JSON or YAML file containing configuration used to generate a document.
It should contain the following structure:
{
"config": Config;
"document": object;
}
It is also possible to define an array with document descriptions to generate multiple documents.
configThe config property contains configuration data used when generating the document. Like the filename of the document.
config.outputDirectoryUse this property to define the directory where the generated document will be saved. For example test-data/products.
config.outputFilenameUse this property to define the generated document filename (with extension). For example product-1.json.
config.outputFormatUse this property to define the generated document data format. For example json or xml.
config.validationSchemaUse this property to define a JSON Schema used to validate the document description. For example schemas/product-document-description.json.
If no config.validationSchema is defined it will not validate the document.
documentThe document property contains the document content.
schema.json
{
"title": "Product document description",
"type": "object",
"properties": {
"document": {
"type": "object",
"properties": {
"id": {
"type": "integer"
},
"name": {
"type": "string"
},
"price": {
"type": "integer"
}
}
}
}
}
product.json
{
"config": {
"outputDirectory": "products",
"outputFilename": "product-1.json",
"outputFormat": "json",
"validationSchema": "schema.json"
},
"document": {
"id": 1,
"name": "Some product",
"price": 100
}
}
Command line
data-document-creator -i 'product.json' -o 'test-data'
test-data/products/product-1.json
{
"id": 1,
"name": "Some product",
"price": 100
}
products.json
[
{
"config": {
"outputDirectory": "products",
"outputFilename": "product-1.json",
"outputFormat": "json"
},
"document": {
"id": 1,
"name": "Some product",
"price": 100
}
},
{
"config": {
"outputDirectory": "products",
"outputFilename": "product-2.json",
"outputFormat": "json"
},
"document": {
"id": 2,
"name": "Some other product",
"price": 200
}
}
]
Command line
data-document-creator -i 'products.json' -o 'test-data'
test-data/products/product-1.json
{
"id": 1,
"name": "Some product",
"price": 100
}
test-data/products/product-2.json
{
"id": 2,
"name": "Some other product",
"price": 200
}
Input files are merged with json-merger before validating and creating the output.
Go to https://www.npmjs.com/package/json-merger for more information.
product-defaults.json
{
"config": {
"outputDirectory": "products",
"outputFilename": {
"$afterMerges": {
"$expression": "`product-${$source.document.id}.json`"
}
},
"outputFormat": "json",
"validationSchema": "schema.json"
}
}
product.json
{
"$merge": {
"source": {
"$import": "product-defaults.json"
},
"with": {
"document": {
"id": 1,
"name": "Some product",
"price": 100
}
}
}
}
Command line
data-document-creator -i 'product.json' -o 'test-data'
test-data/products/product-1.json
{
"id": 1,
"name": "Some product",
"price": 100
}
Usage: data-document-creator [options]
Options:
-V, --version output the version number
-i, --input <files> Glob pattern to specify the documents to process
-o, --output-directory <path> The directory to output the processed documents to. If this param is not set the output is sent to stdout.
-r, --property-removal-indicator <indicator> Remove all properties containing this value. Defaults to '__NILL__'.
-s, --skip-schema-validation Skip JSON schema validation. Defaults to false.
-v, --no-verbose Verbose output
-V, --no-verbose No verbose output
-h, --help output usage information
FAQs
Creates JSON and XML documents
We found that data-document-creator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.