
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@nodesecure/estree-ast-utils
Advanced tools
ESTree compliant utilities to manipulate, extract and transform AST nodes.
This package is available in the Node Package Repository and can be easily installed with npm or yarn.
$ npm i @nodesecure/estree-ast-utils
# or
$ yarn add @nodesecure/estree-ast-utils
Most utility options extend the DefaultOptions interface:
export interface DefaultOptions {
externalIdentifierLookup?(name: string): string | null;
}
You can provide a custom externalIdentifierLookup function to enable the utilities to resolve identifiers from external sources—such as VariableTracer, for example.
Transforms an ESTree ArrayExpression into an iterable of literal values.
["foo", "bar"];
will yield "foo", then "bar".
export interface ArrayExpressionToStringOptions extends DefaultOptions {
/**
* When enabled, resolves the char code of the literal value.
*
* @default true
* @example
* [65, 66] // => ['A', 'B']
*/
resolveCharCode?: boolean;
}
Compute simple ArrayExpression that are using a CallExpression join()
{
host: [
["goo", "g", "gle"].join(""),
"com"
].join(".")
}
Will return google.com
Returns all Literal nodes from a binary expression.
"foo" + "bar";
Will yield "foo", then "bar".
Options are described by the following interface:
interface ConcatBinaryExpressionOptions extends DefaultOptions {
/**
* When set to true, the function will throw an error if it encounters
* a node type that is not supported (i.e., not a Literal, BinaryExpr, ArrayExpr or Identifier).
*
* @default false
* @example
* "foo" + fn() + "bar" // <- will throw an error if `stopOnUnsupportedNode` is true
*/
stopOnUnsupportedNode?: boolean;
}
Recursively extracts all LogicalExpression components.
{ operator: "||" | "&&" | "??", node: ESTree.Expression }
For example:
freeGlobal || freeSelf || Function('return this')();
Will yield three components:
Function('return this')();Returns the literal arguments of a CallExpression.
For example:
eval("require");
Returns
["require"]
Returns the identifier name of a CallExpression, or null if not resolvable.
foobar();
Returns "foobar".
By default, it resolves member expressions. This can be disabled with resolveCallExpression: false.
require('./file.js')();
// ^ Second ^ First
With resolveCallExpression: false, the function will return null.
interface GetCallExpressionIdentifierOptions extends DefaultOptions {
/**
* Resolve the CallExpression callee if it is a MemberExpression.
*
* @default true
* @example
* require('./file.js')();
^ Second ^ First
*/
resolveCallExpression?: boolean;
}
Returns the identifier chain from a MemberExpression.
foo.bar();
will return "foo" then "bar".
Extracts all variable identifiers from a declaration.
const [foo, bar] = [1, 2];
will return "foo" then "bar".
MIT
FAQs
Utilities for AST (ESTree compliant)
We found that @nodesecure/estree-ast-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.