Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
abstract-syntax-tree
Advanced tools
An abstract syntax tree is a way to represent the source code. In case of this library it is represented in the estree format.
For example, the following source code:
const answer = 42
Has the following representation:
{
"type": "Program",
"body": [
{
"type": "VariableDeclaration",
"declarations": [
{
"type": "VariableDeclarator",
"id": {
"type": "Identifier",
"name": "answer"
},
"init": {
"type": "Literal",
"value": 42
}
}
],
"kind": "const"
}
]
}
They're used e.g. for code's:
npm install abstract-syntax-tree
Find all nodes of given type.
const source = 'const a = "x";'
const ast = new AbstractSyntaxTree(source)
ast.find('VariableDeclaration')
Iterate over all nodes of given type.
const source = 'const a = "x";'
const ast = new AbstractSyntaxTree(source)
ast.each('VariableDeclaration', node => {})
Check if ast contains a node of given type.
const source = 'const a = "x";'
const ast = new AbstractSyntaxTree(source)
ast.has('VariableDeclaration')
Count ast nodes of given type.
const source = 'const a = "x"; const b = "y";'
const ast = new AbstractSyntaxTree(source)
ast.count('VariableDeclaration')
First first node of given type.
const source = 'var a = "x";'
const ast = new AbstractSyntaxTree(source)
ast.first('VariableDeclaration')
Find last node of given type.
const source = 'const a = "x";'
const ast = new AbstractSyntaxTree(source)
ast.last('VariableDeclaration')
Remove all nodes that match the criteria.
const source = '"use strict"; const b = 4;'
const ast = new AbstractSyntaxTree(source)
ast.remove({ type: 'Literal', value: 'use strict' })
const source = 'function hello () { const foo = "bar"; return "world"; }'
const ast = new AbstractSyntaxTree(source)
ast.remove('BlockStatement > VariableDeclaration')
Walks over all nodes
const source = 'const a = 1'
const ast = new AbstractSyntaxTree(source)
ast.walk((node, parent) => {})
Walks over all nodes
const source = 'const a = 1'
const ast = new AbstractSyntaxTree(source)
ast.walk({
enter (node) {},
leave (node) {}
})
Replace all nodes that match the criteria.
const source = 'const a = 1'
const ast = new AbstractSyntaxTree(source)
ast.replace({
enter (node) {
if (node.type === 'VariableDeclaration') {
node.kind = 'let'
}
return node
}
})
Prepend a node to the body.
const source = 'const a = 1;'
const ast = new AbstractSyntaxTree(source)
ast.prepend({
type: 'ExpressionStatement',
expression: {
type: 'Literal',
value: 'use strict'
}
})
Append a node to the body.
const source = 'const a = 1;'
const ast = new AbstractSyntaxTree(source)
ast.append({
type: 'ExpressionStatement',
expression: {
type: 'Literal',
value: 'test'
}
})
Wrap body with given node.
const source = 'const a = 1;'
const ast = new AbstractSyntaxTree(source)
ast.wrap(body => {
return [
{
type: 'ExpressionStatement',
expression: {
type: 'CallExpression',
callee: {
type: 'FunctionExpression',
params: [],
body: {
type: 'BlockStatement',
body
}
},
arguments: []
}
}
]
})
Change the code to the first BlockStatement body
const source = '(function () { console.log(1); }())'
const ast = new AbstractSyntaxTree(source)
ast.unwrap()
ast.toSource()
Create ast partials from templates
const source = 'console.log(1);'
const ast = new AbstractSyntaxTree(source)
ast.template('const foo = <%= bar %>;' { bar: { type: 'Literal', value: 1 } })
Add cid to all nodes
const ast = new AbstractSyntaxTree('const a = 1;')
ast.mark()
assert(ast.first('Program').cid === 1)
assert(ast.first('VariableDeclaration').cid === 2)
Convert the ast to string.
const source = 'const a = 1;'
const ast = new AbstractSyntaxTree(source)
const source = ast.toSource()
const source = 'const a = 1;'
const ast = new AbstractSyntaxTree(source)
const { source, map } = ast.toSource({ sourceMap: true })
Generates a source map.
const source = 'const a = 1;'
const ast = new AbstractSyntaxTree(source)
const map = ast.toSourceMap()
1.1.1
FAQs
abstract syntax tree
The npm package abstract-syntax-tree receives a total of 10,509 weekly downloads. As such, abstract-syntax-tree popularity was classified as popular.
We found that abstract-syntax-tree demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.