Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github.com/greymatter-io/toast
ToAST is a thin wrapper for the Go standard library ast package that provides a simple interface for working with Go types.
This package only supports parsing of type definitions. It was originally intended to be used for generating type definitions for other languages -- particularly CUE, a typesafe superset of JSON.
Each go/ast type specification maps to one of four structs:
PlainType
: Basic types, type aliases, and pointersArrayType
: Array and slice typesMapType
: MapsStructType
: Structs, which may contain fields that are themselves one of the four types.There is also partial support for an EnumType
, which is expressed by convention in Go as a type
declaration with a group of constants of the same type.
When parsing a file, ToAST can apply a number of transformations on matching objects:
ExcludeImport
excludes specific importsModifyImport
mutates specific importsExcludeType
excludes specific typesModifyType
mutates specific typesExcludeField
excludes specific fields in a StructType
ModifyField
mutates specific fields in a StructType
CopyIntoStruct
copies fields from one or more named StructType
s into a target StructType
,
replacing the field at of a given namePromoteToEnumType
converts a PlainType
into an EnumType
GenFieldTransform
takes a StructType
and a Field
and returns some Transform
that can be
matched on subsequent nodes in the fileGenEnumTypeTransform
takes a string and go/ast.ValueSpec
and returns a PromoteToEnumType
transform that can be matched on a PlainType
in the fileFirst, load an *ast.File
. For example:
import "go/parser"
filePath := "path/to/file.go"
astFile, err := parser.ParseFile(token.NewFileSet(), filePath, nil, parser.ParseComments)
if err != nil {
panic(err)
}
Then create a *toast.File
:
file := toast.NewFile(astFile,
WithTransform(&toast.ExcludeImport{
Match: func(i Import) bool {
return i.Name == "foo"
}
}),
WithTransform(&toast.ExcludeType{
Match: func(t Type) bool {
return t.Name == "bar"
}
}),
...
)
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.