
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@filtron/core
Advanced tools
Filtron parses human-friendly filter strings into structured queries you can use anywhere — SQL databases, in-memory arrays, or your own custom backend.
A fast, human-friendly filter language for JavaScript and TypeScript. Parse expressions like age > 18 AND verified into a type-safe AST.
Let users filter data with readable expressions instead of building complex query UIs:
price < 100 AND category : ["electronics", "books"] AND inStock
Filtron parses these expressions into a structured AST you can use to generate SQL, filter arrays, or build custom query backends — safely, with no risk of injection attacks.
Use cases: Search UIs, API query parameters, admin dashboards, real-time data filtering.
npm install @filtron/core
Optional helpers:
@filtron/sql — Generate parameterized SQL WHERE clauses@filtron/js — Filter JavaScript arrays in-memoryimport { parse } from "@filtron/core";
const result = parse('age > 18 AND status = "active"');
if (result.success) {
console.log(result.ast);
} else {
console.error(result.error);
}
// Comparisons
parse('age > 18');
parse('status = "active"');
parse('role != "guest"');
// Boolean logic
parse('age > 18 AND verified');
parse('admin OR moderator');
parse('NOT suspended');
parse('(admin OR mod) AND active');
// Field existence
parse('email?');
parse('profile EXISTS');
// Contains (substring)
parse('name ~ "john"');
// One-of (IN)
parse('status : ["pending", "approved"]');
// Ranges
parse('age = 18..65');
parse('price = 9.99..99.99');
// Nested fields
parse('user.profile.age >= 18');
| Operator | Meaning | Example |
|---|---|---|
=, : | Equal | status = "active" |
!=, !: | Not equal | role != "guest" |
>, >=, <, <= | Comparison | age >= 18 |
~ | Contains | name ~ "john" |
?, EXISTS | Field exists | email? |
.. | Range | age = 18..65 |
: [...] | One of | status : ["a", "b"] |
AND, OR, NOT | Boolean logic | a AND (b OR c) |
parse(input: string): ParseResultParses a filter expression and returns a result object.
const result = parse('age > 18');
if (result.success) {
result.ast; // ASTNode
} else {
result.error; // string
}
parseOrThrow(input: string): ASTNodeParses a filter expression, throwing on invalid input.
try {
const ast = parseOrThrow('age > 18');
} catch (error) {
console.error(error.message);
}
All AST types are exported for building custom consumers:
import type {
ParseResult,
ASTNode,
AndExpression,
OrExpression,
NotExpression,
ComparisonExpression,
ExistsExpression,
BooleanFieldExpression,
OneOfExpression,
NotOneOfExpression,
RangeExpression,
Value,
ComparisonOperator,
StringValue,
NumberValue,
BooleanValue,
IdentifierValue,
} from "@filtron/core";
| Node Type | Fields | Example input |
|---|---|---|
and | left, right | a AND b |
or | left, right | a OR b |
not | expression | NOT a |
comparison | field, operator, value | age > 18 |
exists | field | email? |
booleanField | field | verified |
oneOf | field, values | status : ["a", "b"] |
notOneOf | field, values | status !: ["a", "b"] |
range | field, min, max | age = 18..65 |
Example output:
parse('age > 18 AND status = "active"')
// Returns:
{
success: true,
ast: {
type: "and",
left: {
type: "comparison",
field: "age",
operator: ">",
value: { type: "number", value: 18 }
},
right: {
type: "comparison",
field: "status",
operator: "=",
value: { type: "string", value: "active" }
}
}
}
Hand-written recursive descent parser. ~9 KB minified, zero dependencies.
| Query complexity | Parse time | Throughput |
|---|---|---|
| Simple | ~90-250ns | 4-11M ops/sec |
| Medium | ~360-870ns | 1.1-2.8M ops/sec |
| Complex | ~0.9-1.5μs | 650K-1.1M ops/sec |
MIT
FAQs
Filtron parses human-friendly filter strings into structured queries you can use anywhere — SQL databases, in-memory arrays, or your own custom backend.
The npm package @filtron/core receives a total of 3 weekly downloads. As such, @filtron/core popularity was classified as not popular.
We found that @filtron/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.