
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
xmlbuilder
Advanced tools
An XML builder for node.js similar to java-xmlbuilder.
xmlbuilder2:The new release of xmlbuilder is available at xmlbuilder2! xmlbuilder2 has been redesigned from the ground up to be fully conforming to the modern DOM specification. It supports XML namespaces, provides built-in converters for multiple formats, collection functions, and more. Please see upgrading from xmlbuilder in the wiki.
New development will be focused towards xmlbuilder2; xmlbuilder will only receive critical bug fixes.
npm install xmlbuilder
var builder = require('xmlbuilder');
var xml = builder.create('root')
.ele('xmlbuilder')
.ele('repo', {'type': 'git'}, 'git://github.com/oozcitak/xmlbuilder-js.git')
.end({ pretty: true});
console.log(xml);
will result in:
<?xml version="1.0"?>
<root>
<xmlbuilder>
<repo type="git">git://github.com/oozcitak/xmlbuilder-js.git</repo>
</xmlbuilder>
</root>
It is also possible to convert objects into nodes:
var builder = require('xmlbuilder');
var obj = {
root: {
xmlbuilder: {
repo: {
'@type': 'git', // attributes start with @
'#text': 'git://github.com/oozcitak/xmlbuilder-js.git' // text node
}
}
}
};
var xml = builder.create(obj).end({ pretty: true});
console.log(xml);
If you need to do some processing:
var builder = require('xmlbuilder');
var root = builder.create('squares');
root.com('f(x) = x^2');
for(var i = 1; i <= 5; i++)
{
var item = root.ele('data');
item.att('x', i);
item.att('y', i * i);
}
var xml = root.end({ pretty: true});
console.log(xml);
This will result in:
<?xml version="1.0"?>
<squares>
<!-- f(x) = x^2 -->
<data x="1" y="1"/>
<data x="2" y="4"/>
<data x="3" y="9"/>
<data x="4" y="16"/>
<data x="5" y="25"/>
</squares>
See the wiki for details and examples for more complex examples.
fast-xml-parser is a very fast XML to JavaScript object converter. It can also convert back from an object to XML. It provides options to validate, parse, or traverse XML. It is different from xmlbuilder in that it focuses on parsing existing XML content rather than building new XML documents.
xml2js is another popular package that can convert XML to a JavaScript object and vice versa. It is similar to xmlbuilder in that it allows for the creation of XML, but it also provides parsing capabilities, which xmlbuilder does not.
xml-js can convert XML text to a JavaScript object (JSON) and vice versa. It provides a comprehensive set of options for conversion and can handle comments, processing instructions, and CDATA. It is similar to xmlbuilder but also includes conversion from XML to JSON.
FAQs
An XML builder for node.js
The npm package xmlbuilder receives a total of 42,492,077 weekly downloads. As such, xmlbuilder popularity was classified as popular.
We found that xmlbuilder demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.