
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@brombaut/monkey-parser
Advanced tools
Parser for the Monkey programming language. Useful for visualizing the generated AST.
Port to TypeScript of the components from "Writing An Interpreter In Go" by Thorsten Bell for generating an AST.
https://brombaut.github.io/monkey-ast-visualizer/
$ npm install @brombaut/monkey-parser
const parser = require('@brombaut/monkey-parser');
const input = `
let x = 1;
let y = 2;
let add = fn(a, b) { return a + b };
let result = add(x, y);
`;
parser.parse(input);
if (parser.errors().length > 0) {
parser.errors().forEach(console.error);
} else {
const ast = parser.ast();
console.log(ast);
}
Below are some code examples that showcase the language features of Monkey.
// Bind values to names with let-statements
let version = 1;
let name = "Monkey programming language";
let myArray = [1, 2, 3, 4, 5];
let coolBooleanLiteral = true;
// Use expressions to produce values
let awesomeValue = (10 / 2) * 5 + 30;
let arrayWithValues = [1 + 1, 2 * 2, 3];
// Define a `fibonacci` function
let fibonacci = fn(x) {
if (x == 0) {
0 // Monkey supports implicit returning of values
} else {
if (x == 1) {
return 1; // ... and explicit return statements
} else {
fibonacci(x - 1) + fibonacci(x - 2); // Recursion
}
}
};
// Here is an array containing two hashes, that use strings as keys
// and integers and strings as values
let people = [{"name": "Anna", "age": 24}, {"name": "Bob", "age": 99}];
// Getting elements out of the data types is also supported.
// Here is how we can access array elements by using index expressions:
fibonacci(myArray[4]);
// => 5
// We can also access hash elements with index expressions:
let getName = fn(person) { person["name"]; };
// And here we access array elements and call a function with the element as argument:
getName(people[0]); // => "Anna"
getName(people[1]); // => "Bob"
// Define the higher-order function `map`, that calls the given function `f` on
// each element in `arr` and returns an array of the produced values.
let map = fn(arr, f) {
let iter = fn(arr, accumulated) {
if (len(arr) == 0) {
accumulated
} else {
iter(rest(arr), push(accumulated, f(first(arr))));
}
};
iter(arr, []);
};
// Now let's take the `people` array and the `getName` function from above
// and use them with `map`.
map(people, getName); // => ["Anna", "Bob"]
// newGreeter returns a new function, that greets a `name` with the given 'greeting`.
let newGreeter = fn(greeting) {
// `puts` is a built-in function we add to the interpreter
return fn(name) { puts(greeting + " " + name); }
};
// `hello` is a greeter function that says "Hello"
let hello = newGreeter("Hello");
// Calling it outputs the greeting:
hello("dear, future Reader!"); // => Hello dear, future Reader!
FAQs
Parser for the Monkey programming language. Useful for visualizing the generated AST.
The npm package @brombaut/monkey-parser receives a total of 1 weekly downloads. As such, @brombaut/monkey-parser popularity was classified as not popular.
We found that @brombaut/monkey-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.