
Security News
Insecure Agents Podcast: Certified Patches, Supply Chain Security, and AI Agents
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.
@nodesecure/estree-ast-utils
Advanced tools
ESTree compliant utilities to manipulate, extract and transform AST nodes.
This package is available in the Node Package Repository and can be easily installed with npm or yarn.
$ npm i @nodesecure/estree-ast-utils
# or
$ yarn add @nodesecure/estree-ast-utils
Most utility options extend the DefaultOptions interface:
export interface DefaultOptions {
externalIdentifierLookup?(name: string): string | null;
}
You can provide a custom externalIdentifierLookup function to enable the utilities to resolve identifiers from external sources—such as VariableTracer, for example.
Transforms an ESTree ArrayExpression into an iterable of literal values.
["foo", "bar"];
will yield "foo", then "bar".
export interface ArrayExpressionToStringOptions extends DefaultOptions {
/**
* When enabled, resolves the char code of the literal value.
*
* @default true
* @example
* [65, 66] // => ['A', 'B']
*/
resolveCharCode?: boolean;
}
Compute simple ArrayExpression that are using a CallExpression join()
{
host: [
["goo", "g", "gle"].join(""),
"com"
].join(".")
}
Will return google.com
Returns all Literal nodes from a binary expression.
"foo" + "bar";
Will yield "foo", then "bar".
Options are described by the following interface:
interface ConcatBinaryExpressionOptions extends DefaultOptions {
/**
* When set to true, the function will throw an error if it encounters
* a node type that is not supported (i.e., not a Literal, BinaryExpr, ArrayExpr or Identifier).
*
* @default false
* @example
* "foo" + fn() + "bar" // <- will throw an error if `stopOnUnsupportedNode` is true
*/
stopOnUnsupportedNode?: boolean;
}
Recursively extracts all LogicalExpression components.
{ operator: "||" | "&&" | "??", node: ESTree.Expression }
For example:
freeGlobal || freeSelf || Function('return this')();
Will yield three components:
Function('return this')();Returns the literal arguments of a CallExpression.
For example:
eval("require");
Returns
["require"]
Returns the identifier name of a CallExpression, or null if not resolvable.
foobar();
Returns "foobar".
By default, it resolves member expressions. This can be disabled with resolveCallExpression: false.
require('./file.js')();
// ^ Second ^ First
With resolveCallExpression: false, the function will return null.
interface GetCallExpressionIdentifierOptions extends DefaultOptions {
/**
* Resolve the CallExpression callee if it is a MemberExpression.
*
* @default true
* @example
* require('./file.js')();
^ Second ^ First
*/
resolveCallExpression?: boolean;
}
Returns the identifier chain from a MemberExpression.
foo.bar();
will return "foo" then "bar".
Extracts all variable identifiers from a declaration.
const [foo, bar] = [1, 2];
will return "foo" then "bar".
MIT
FAQs
Utilities for AST (ESTree compliant)
The npm package @nodesecure/estree-ast-utils receives a total of 2,269 weekly downloads. As such, @nodesecure/estree-ast-utils popularity was classified as popular.
We found that @nodesecure/estree-ast-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.

Security News
The planned feature introduces a review step before releases go live, following the Shai-Hulud attacks and a rocky migration off classic tokens that disrupted maintainer workflows.