
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
@nodesecure/estree-ast-utils
Advanced tools
ESTree compliant utilities to manipulate, extract and transform AST nodes.
This package is available in the Node Package Repository and can be easily installed with npm or yarn.
$ npm i @nodesecure/estree-ast-utils
# or
$ yarn add @nodesecure/estree-ast-utils
Most utility options extend the DefaultOptions interface:
export interface DefaultOptions {
externalIdentifierLookup?(name: string): string | null;
}
You can provide a custom externalIdentifierLookup function to enable the utilities to resolve identifiers from external sources—such as VariableTracer, for example.
Transforms an ESTree ArrayExpression into an iterable of literal values.
["foo", "bar"];
will yield "foo", then "bar".
export interface ArrayExpressionToStringOptions extends DefaultOptions {
/**
* When enabled, resolves the char code of the literal value.
*
* @default true
* @example
* [65, 66] // => ['A', 'B']
*/
resolveCharCode?: boolean;
}
Compute simple ArrayExpression that are using a CallExpression join()
{
host: [
["goo", "g", "gle"].join(""),
"com"
].join(".")
}
Will return google.com
Returns all Literal nodes from a binary expression.
"foo" + "bar";
Will yield "foo", then "bar".
Options are described by the following interface:
interface ConcatBinaryExpressionOptions extends DefaultOptions {
/**
* When set to true, the function will throw an error if it encounters
* a node type that is not supported (i.e., not a Literal, BinaryExpr, ArrayExpr or Identifier).
*
* @default false
* @example
* "foo" + fn() + "bar" // <- will throw an error if `stopOnUnsupportedNode` is true
*/
stopOnUnsupportedNode?: boolean;
}
Recursively extracts all LogicalExpression components.
{ operator: "||" | "&&" | "??", node: ESTree.Expression }
For example:
freeGlobal || freeSelf || Function('return this')();
Will yield three components:
Function('return this')();Returns the literal arguments of a CallExpression.
For example:
eval("require");
Returns
["require"]
Returns the identifier name of a CallExpression, or null if not resolvable.
foobar();
Returns "foobar".
By default, it resolves member expressions. This can be disabled with resolveCallExpression: false.
require('./file.js')();
// ^ Second ^ First
With resolveCallExpression: false, the function will return null.
interface GetCallExpressionIdentifierOptions extends DefaultOptions {
/**
* Resolve the CallExpression callee if it is a MemberExpression.
*
* @default true
* @example
* require('./file.js')();
^ Second ^ First
*/
resolveCallExpression?: boolean;
}
Returns the identifier chain from a MemberExpression.
foo.bar();
will return "foo" then "bar".
Extracts all variable identifiers from a declaration.
const [foo, bar] = [1, 2];
will return "foo" then "bar".
MIT
FAQs
Utilities for AST (ESTree compliant)
The npm package @nodesecure/estree-ast-utils receives a total of 1,559 weekly downloads. As such, @nodesecure/estree-ast-utils popularity was classified as popular.
We found that @nodesecure/estree-ast-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.