Investigate use of `xml2js` and replace with `fast-xml-parser`

[AriajSarkar]

xml2js is a widely used XML parser (~25M weekly downloads) that depends on sax and xmlbuilder. It has been largely inactive in terms of maintenance.

fast-xml-parser is a zero-dependency, actively maintained, and significantly faster alternative (~35M weekly downloads).

Why replace?

• xml2js pulls in sax and xmlbuilder as dependencies, adding to install size
• xml2js has received minimal maintenance updates
• fast-xml-parser has zero dependencies, is faster, and is already the most downloaded XML parser on npm
• Reducing unnecessary dependency trees also reduces supply chain attack surface (relevant after the Sept 2025 npm supply chain incidents)

Replacement

Replace xml2js → fast-xml-parser

Note: fast-xml-parser has a different default output format than xml2js. Configuration options exist to match the xml2js output style — see parsing options docs.

Dependents

npx github:Fuzzyma/e18e-tools xml2js -n 100 -q -o md -U https://npm.devminer.xyz/registry

---

#	Downloads	Traffic	Version	Package
1	27.24M	23382.46 GB	0.6.2	aws-sdk
2	14.09M	12092.55 GB	0.6.0	@expo/config-plugins
3	9.74M	8357.34 GB	0.6.0	@expo/prebuild-config
4	5.60M	4809.64 GB	^0.5.0	parse-bmfont-xml
5	3.60M	3087.30 GB	^0.5.0	@azure/core-http
6	3.58M	3070.62 GB	0.6.2	serverless
7	3.30M	2830.85 GB	^0.6.2	@capacitor/cli
8	3.23M	2770.38 GB	^0.5.0	@azure/ms-rest-js
9	2.98M	2558.55 GB	^0.5.0	@vscode/vsce
10	2.41M	2067.83 GB	^0.4.17	webdriver-manager
11	2.18M	1868.81 GB	^0.6.2	jsforce
12	1.78M	1528.26 GB	^0.5.0	rss-parser
13	1.77M	1522.64 GB	^0.6.0	azurite
14	1.69M	1453.01 GB	^0.5.0 || ^0.6.2	minio
15	1.62M	1388.66 GB	^0.6.2	@jsforce/jsforce-node
16	1.09M	937.39 GB	^0.6.2	@node-saml/node-saml
17	802.60k	688.96 GB	^0.5.0	office-addin-manifest
18	795.71k	683.05 GB	^0.6.2	firefox-profile
19	738.01k	633.52 GB	0.6.2	n8n-workflow
20	675.48k	579.84 GB	^0.6.1	favicons
21	617.10k	529.72 GB	^0.6.2	@ui5/project
22	608.97k	522.75 GB	^0.6.2	epub2
23	563.36k	483.60 GB	^0.6.2	@ui5/builder
24	486.55k	417.66 GB	0.5.0	braintree
25	342.99k	294.43 GB	^0.6.2	@usebruno/js
26	335.19k	287.73 GB	~0.2.8	azure-storage
27	331.46k	284.53 GB	^0.6.2	ali-oss
28	321.17k	275.70 GB	0.6.2	n8n-core
29	318.83k	273.69 GB	^0.6.0	xunit-viewer
30	315.16k	270.54 GB	0.4.17	svg-react-loader
31	297.14k	255.07 GB	^0.6.2	@usebruno/converters
32	292.26k	250.88 GB	0.6.2	@sap/service-provider-apis
33	281.77k	241.88 GB	^0.4.23	passport-saml
34	265.56k	227.96 GB	^0.6.2	express-xml-bodyparser
35	260.66k	223.76 GB	^0.5.0	@microsoft/teamsfx-core
36	259.61k	222.85 GB	^0.6.2	@currents/cmd
37	255.65k	219.46 GB	^0.4.5	map-canvas
38	247.35k	212.33 GB	0.6.2	n8n-nodes-base
39	242.15k	207.87 GB	0.6.2	n8n
40	223.30k	191.69 GB	^0.5.0	body-parser-xml
41	190.31k	163.36 GB	^0.4.4	knox
42	182.34k	156.53 GB	0.6.2	@node-red/nodes
43	150.40k	129.10 GB	0.5.0	@sap/wing-service-explorer
44	147.14k	126.30 GB	^0.4.23	http-cas-client
45	139.47k	119.72 GB	^0.4.23	vsce
46	137.62k	118.13 GB	^0.5.0	@vscode/l10n-dev
47	134.27k	115.26 GB	^0.6.2	junit-to-ctrf
48	127.33k	109.30 GB	>=0.4.23	node-rest-client
49	121.39k	104.21 GB	^0.4.19	azure-common
50	120.89k	103.78 GB	0.5.0	tmexchange
51	120.27k	103.24 GB	0.5.0	resx
52	115.47k	99.12 GB	0.6.2	junit2json
53	114.99k	98.71 GB	0.6.2	@boxyhq/saml20
54	100.23k	86.04 GB	0.4.19	domotz-remote-pawn
55	93.64k	80.38 GB	^0.4.23	api-spec-converter
56	93.34k	80.12 GB	^0.5.0	plivo
57	92.36k	79.29 GB	^0.6.2	@adobe/pdfservices-node-sdk
58	86.06k	73.87 GB	^0.6.0	geostyler-qgis-parser
59	86.00k	73.83 GB	^0.4.23	webfont
60	84.11k	72.20 GB	^0.4.8	strong-remoting
61	78.21k	67.14 GB	^0.6.2	onvif
62	77.13k	66.21 GB	0.6.2	@sap/webide-hdi-feature-vscode
63	76.76k	65.89 GB	^0.6.2	@ui5/middleware-code-coverage
64	76.61k	65.77 GB	^0.5.0	pptx2json
65	76.50k	65.67 GB	0.6.2	@testim/testim-cli
66	74.62k	64.05 GB	^0.6.2	flexbiz-server
67	73.55k	63.14 GB	^0.4.19	csproj2ts
68	72.54k	62.27 GB	^0.6.2	libphonenumber-metadata-generator
69	69.09k	59.31 GB	0.4.17	any-json
70	68.62k	58.90 GB	^0.6.2	@achingbrain/ssdp
71	68.24k	58.58 GB	^0.6.0	@achingbrain/nat-port-mapper
72	65.73k	56.43 GB	^0.6.0	@alicloud/tea-xml
73	65.63k	56.34 GB	^0.6.2	snyk-nuget-plugin
74	60.10k	51.60 GB	^0.6.2	lost-pixel
75	57.35k	49.23 GB	^0.6.2	camoufox-js
76	56.29k	48.32 GB	^0.4.23	@intacct/intacct-sdk
77	55.20k	47.39 GB	^0.6.2	@homebridge/dbus-native
78	55.13k	47.33 GB	^0.6.2	ibm-cos-sdk
79	52.78k	45.31 GB	0.6.2	lingo.dev
80	52.74k	45.27 GB	0.6.2	dotnet-deps-parser
81	52.20k	44.81 GB	^0.6.2	@darabonba/typescript
82	51.67k	44.35 GB	0.4.0	restler
83	50.60k	43.44 GB	^0.6.0	officecrypto-tool
84	49.82k	42.77 GB	^0.4.9	pom-parser
85	49.67k	42.64 GB	^0.5.0	appcenter-cli
86	49.58k	42.56 GB	^0.6.2	vite-plugin-magical-svg
87	49.20k	42.23 GB	^0.5.0	@alicloud/pop-core
88	47.10k	40.43 GB	^0.6.2	@silentbot1/nat-api
89	46.21k	39.67 GB	0.4.19	salesforce-alm
90	44.65k	38.33 GB	^0.4.19	node-ses
91	44.05k	37.82 GB	^0.5.0	chai-xml
92	43.90k	37.68 GB	^0.4.10	svg-to-jsx
93	42.44k	36.43 GB	^0.4.23	raml-typesystem
94	40.22k	34.53 GB	0.6.2	office-text-extractor
95	37.40k	32.11 GB	^0.6.0	@odata2ts/odata2ts
96	33.25k	28.54 GB	^0.5.0	vscode-nls-dev
97	32.53k	27.93 GB	^0.5.0	tfx-cli
98	32.00k	27.47 GB	^0.4.17	netstorageapi
99	31.90k	27.38 GB	^0.6.2	@cap-js-community/odata-v2-adapter
100	30.21k	25.93 GB	^0.6.2	@salesforce/plugin-lightning-dev

---

Progress

• Identify specific migration paths for top dependents
• First contact with maintainers of top dependents

[rubiesonthesky]

• 1 deprecated
• 10 not marked deprecated but it doesn't seem that it's maintained and I don't think Angular recommends using it anymore