Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@babel/generator
Advanced tools
The @babel/generator package is a part of the Babel toolchain that is responsible for generating code from an Abstract Syntax Tree (AST). It takes an AST as input and turns it into code with source maps, if desired. This is particularly useful when you want to transform code using Babel and then generate the transformed code.
Code Generation from AST
This feature allows you to generate code from an AST. The code sample demonstrates parsing a piece of code into an AST and then generating the code back from the AST.
const { parse } = require('@babel/parser');
const generate = require('@babel/generator').default;
const code = 'let a = 1;';
const ast = parse(code);
const output = generate(ast, {}, code);
console.log(output.code);
Source Map Support
This feature enables the generation of source maps along with the generated code. The code sample shows how to generate a source map for the code that is being generated from an AST.
const { parse } = require('@babel/parser');
const generate = require('@babel/generator').default;
const code = 'let a = 1;';
const ast = parse(code);
const output = generate(ast, { sourceMaps: true }, code);
console.log(output.map);
Escodegen is an ECMAScript code generator that takes an AST and converts it back into code. It is similar to @babel/generator but does not provide the same level of integration with the Babel ecosystem.
Recast is a JavaScript AST tool that allows you to parse, visit, and transform the nodes of your AST, and then regenerate JavaScript code. It preserves the original formatting as much as possible and can be used in conjunction with Babel.
Astring is a tiny and fast JavaScript code generator from an ESTree-compliant AST. It is smaller and may be faster than @babel/generator but lacks the extensive plugin system and integrations that Babel offers.
Turns an AST into code.
npm install --save-dev @babel/generator
import {parse} from 'babylon';
import generate from '@babel/generator';
const code = 'class Example {}';
const ast = parse(code);
const output = generate(ast, { /* options */ }, code);
Options for formatting output:
name | type | default | description |
---|---|---|---|
auxiliaryCommentBefore | string | Optional string to add as a block comment at the start of the output file | |
auxiliaryCommentAfter | string | Optional string to add as a block comment at the end of the output file | |
shouldPrintComment | function | opts.comments | Function that takes a comment (as a string) and returns true if the comment should be included in the output. By default, comments are included if opts.comments is true or if opts.minifed is false and the comment contains @preserve or @license |
retainLines | boolean | false | Attempt to use the same line numbers in the output code as in the source code (helps preserve stack traces) |
retainFunctionParens | boolean | false | Retain parens around function expressions (could be used to change engine parsing behavior) |
comments | boolean | true | Should comments be included in output |
compact | boolean or 'auto' | opts.minified | Set to true to avoid adding whitespace for formatting |
minified | boolean | false | Should the output be minified |
concise | boolean | false | Set to true to reduce whitespace (but not as much as opts.compact ) |
filename | string | Used in warning messages | |
jsonCompatibleStrings | boolean | false | Set to true to run jsesc with "json": true to print "\u00A9" vs. "©"; |
Options for source maps:
name | type | default | description |
---|---|---|---|
sourceMaps | boolean | false | Enable generating source maps |
sourceMapTarget | string | The filename of the generated code that the source map will be associated with | |
sourceRoot | string | A root for all relative URLs in the source map | |
sourceFileName | string | The filename for the source code (i.e. the code in the code argument). This will only be used if code is a string. |
In most cases, Babel does a 1:1 transformation of input-file to output-file. However,
you may be dealing with AST constructed from multiple sources - JS files, templates, etc.
If this is the case, and you want the sourcemaps to reflect the correct sources, you'll need
to pass an object to generate
as the code
parameter. Keys
should be the source filenames, and values should be the source content.
Here's an example of what that might look like:
import {parse} from 'babylon';
import generate from '@babel/generator';
const a = 'var a = 1;';
const b = 'var b = 2;';
const astA = parse(a, { sourceFilename: 'a.js' });
const astB = parse(b, { sourceFilename: 'b.js' });
const ast = {
type: 'Program',
body: [].concat(astA.program.body, astB.program.body)
};
const { code, map } = generate(ast, { sourceMaps: true }, {
'a.js': a,
'b.js': b
});
// Sourcemap will point to both a.js and b.js where appropriate.
FAQs
Turns an AST into code.
The npm package @babel/generator receives a total of 0 weekly downloads. As such, @babel/generator popularity was classified as not popular.
We found that @babel/generator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.