
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@codemirror/language
Advanced tools
[ WEBSITE | DOCS | ISSUES | FORUM | CHANGELOG ]
This package implements the language support infrastructure for the CodeMirror code editor.
The project page has more information, a number of examples and the documentation.
This code is released under an MIT license.
We aim to be an inclusive, welcoming community. To make that explicit, we have a code of conduct that applies to communication around the project.
Setting up a language from a Lezer parser looks like this:
import {parser} from "@lezer/json"
import {LRLanguage, continuedIndent, indentNodeProp,
foldNodeProp, foldInside} from "@codemirror/language"
export const jsonLanguage = LRLanguage.define({
name: "json",
parser: parser.configure({
props: [
indentNodeProp.add({
Object: continuedIndent({except: /^\s*\}/}),
Array: continuedIndent({except: /^\s*\]/})
}),
foldNodeProp.add({
"Object Array": foldInside
})
]
}),
languageData: {
closeBrackets: {brackets: ["[", "{", '"']},
indentOnInput: /^\s*[\}\]]$/
}
})
Often, you'll also use this package just to access some specific language-related features, such as accessing the editor's syntax tree...
import {syntaxTree} from "@codemirror/language"
const tree = syntaxTree(view)
... or computing the appriate indentation at a given point.
import {getIndentation} from "@codemirror/language"
console.log(getIndentation(view.state, view.state.selection.main.head))
6.11.3 (2025-08-15)
Make the stream parser user 4 times smaller chunks to reduce the amount of re-parsed code on changes.
The Monaco Editor is the code editor that powers VS Code, offering rich language support and development features. Compared to @codemirror/language, Monaco provides a more extensive set of features out of the box, including integrated syntax highlighting, autocompletion, and debugging for a wide range of languages. However, it might be heavier and more complex to integrate into web projects.
Ace is another popular code editor library that can be embedded in web pages and applications. Similar to @codemirror/language, it offers syntax highlighting, autocompletion, and other editing features for various programming languages. Ace is known for its extensibility and customizability, though it might not be as modern or as actively developed as CodeMirror.
FAQs
Language support infrastructure for the CodeMirror code editor
The npm package @codemirror/language receives a total of 2,623,234 weekly downloads. As such, @codemirror/language popularity was classified as popular.
We found that @codemirror/language demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.