
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A complete implementation of the printf C functions family
for Node.JS, written in pure JavaScript.
Bonus! You get extra features, like the %O converter (which inspects
the argument). See Extra Features below.
Via NPM:
$ npm install printf
Use it like you would in C (printf/sprintf):
var printf = require('printf');
var result = printf(format, args...);
It can also output the result for you, as fprintf:
var printf = require('printf');
printf(write_stream, format, args...);
(space)assert.eql(' -42', printf('% 5d', -42));
+ (plus)assert.eql(' +42', printf('%+5d', 42));
0 (zero)assert.eql('00042', printf('%05d', 42));
- (minus)assert.eql('42 ', printf('%-5d', 42));
assert.eql('42.90', printf('%.2f', 42.8952));
assert.eql('042.90', printf('%06.2f', 42.8952));
assert.eql('\x7f', printf('%c', 0x7f));
assert.eql('a', printf('%c', 'a'));
assert.eql('"', printf('%c', 34));
assert.eql('10%', printf('%d%%', 10));
assert.eql('+hello+', printf('+%s+', 'hello'));
assert.eql("a", printf("%c", "a"));
assert.eql('"', printf("%c", 34));
assert.eql('$', printf('%c', 36));
assert.eql("10", printf("%d", 10));
The %O converter will call util.inspect(...) at the argument:
assert.eql("Debug: { hello: 'Node', repeat: false }",
printf('Debug: %O', {hello: 'Node', "repeat": false})
);
assert.eql("Test: { hello: 'Node' }",
printf('%2$s: %1$O', {"hello": 'Node'}, 'Test')
);
Important: it's a capital "O", not a zero!
Specifying a precision lets you control the depth up to which the object is formatted:
assert.eql("Debug: { depth0: { depth1_: 0, depth1: [Object] } }",
printf('Debug: %.1O', {depth0: {depth1: {depth2: {depth3: true}}, depth1_: 0}})
);
You can use the alternative form flag together with %O to disable representation of non-enumerable properties (useful for arrays):
assert.eql("With non-enumerable properties: [ 1, 2, 3, 4, 5, [length]: 5 ]",
printf('With non-enumerable properties: %O', [1, 2, 3, 4, 5])
);
assert.eql("Without non-enumerable properties: [ 1, 2, 3, 4, 5 ]",
printf('Without non-enumerable properties: %#O', [1, 2, 3, 4, 5])
);
You can use the sign flag together with %O to enable colors in util.inspect:
assert.eql("With colors: { bar: \u001b[33mtrue\u001b[39m, baz: \u001b[33mfalse\u001b[39m }",
printf('With colors: %+O', {bar: true, baz: false})
);
In addition to the old-fashioned n$,
you can use hashes and property names!
assert.eql('Hot Pockets',
printf('%(temperature)s %(crevace)ss', {
temperature: 'Hot',
crevace: 'Pocket'
})
);
assert.eql('Hot Pockets',
printf('%2$s %1$ss', 'Pocket', 'Hot')
);
Length and precision can now be variable:
assert.eql(' foo', printf('%*s', 'foo', 4));
assert.eql(' 3.14', printf('%*.*f', 3.14159265, 10, 2));
assert.eql('000003.142', printf('%0*.*f', 3.14159265, 10, 3));
assert.eql('3.1416 ', printf('%-*.*f', 3.14159265, 10, 4));
Tests are written in CoffeeScript and are executed with Mocha. To use it, simple run npm install, it will install Mocha and its dependencies in your project's node_modules directory followed by npm test.
To run the tests:
npm install
npm test
The test suite is run online with Travis against the versions 6, 7, 8 and 9 of Node.js.
This package is developed by Adaltas.
The sprintf-js package provides similar functionality to printf, offering a JavaScript implementation of the sprintf function. It supports a wide range of format specifiers and is highly configurable. Compared to printf, sprintf-js offers more extensive documentation and additional features like named arguments.
The util package is a core Node.js module that includes the util.format function, which provides similar string formatting capabilities. While not as feature-rich as printf or sprintf-js, util.format is built into Node.js and does not require an additional dependency.
FAQs
Full implementation of the `printf` family in pure JS.
The npm package printf receives a total of 391,187 weekly downloads. As such, printf popularity was classified as popular.
We found that printf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.