
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
html-parser2
Advanced tools
npm install html-parser2 -s
/**
作者:阮家友
时间:2017-5-12 10:53:43
说明:html Node节点对象
2017-5-15 14:18:01 修改_calc中bFound为false时的bug
2017-5-15 22:15:05 es6改写
2017-6-2 15:04:54 innerText中while死循环bug
2017-7-8 16:14:20 debug:有时获取到了数据但timeout了 ...
2017-8-4 19:46:54 解决引号中的引号转义问题
2017-9-2 10:21:23 parse传入的html不是字符串 bug处理
构造中传入html进行初始化
增加toString()方法
解决最后面的文本没有变成节点的bug
2017-9-17 17:54:25 补充toJSON方法
2017-9-18 00:22:20 发现解析节点时字符串中的换行之类的空白字符造成节点被识别为文字 心累 全replace吧
2017-9-18 14:14:27 removeChild有问题 奇怪 添加remove方法
2017-9-18 17:39:29 $方法补充分组,
2017-9-19 15:39:05 改写$
2017-9-20 17:20:18 解决文本中有引号的bug 字符串只能在标签内
2017-9-22 23:12:13 script标签中有标签字符串的bug:textarea、xmp、pre、code、
strong、em、font、img、q、b、quoteblock、pre、s、small、span、label、sub、sup、
2017-10-1 04:34:22 要改的地方 node改为tag,内部方法用前缀_,bfs改为异步,但bfs中修改节 点是个大问题
Text属性改为text,
2018-2-2 16:53:30 token词法分析,vQuery函数工厂
2018-2-6 15:42:20 纠错:HTML解析时遍历修改所有ST节点;标签中多了个引号....怎么办? 简单的判断字符串前是不是=
**/
1.基本的Node处理
2.html片段解析
3.添加测试
参考superagent封装shttp
解决nodejs循环引用问题(放在同一个文件~~ 用babel或者等v8更好~~)
TODO:$选择器与util中的_
更新uri-parser-helper版本
FAQs
html解析与相关节点API接口
We found that html-parser2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.