Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
acorn-loose
Advanced tools
The acorn-loose npm package is a variant of the Acorn JavaScript parser that is designed to handle syntax errors more gracefully. It allows you to parse JavaScript code that may not be entirely correct, making it useful for applications like code editors, linters, and other tools that need to work with incomplete or incorrect code.
Parsing JavaScript with Syntax Errors
This feature allows you to parse JavaScript code that contains syntax errors. The acorn-loose parser will attempt to create an Abstract Syntax Tree (AST) even if the code is not entirely correct.
const acornLoose = require('acorn-loose');
const code = 'var a = 1 +';
const ast = acornLoose.parse(code);
console.log(ast);
Handling Incomplete Code
This feature is useful for parsing incomplete code snippets, such as those that might be found in a code editor while the user is still typing.
const acornLoose = require('acorn-loose');
const incompleteCode = 'function test() {';
const ast = acornLoose.parse(incompleteCode);
console.log(ast);
Esprima is a high-performance, standard-compliant ECMAScript parser written in JavaScript. Unlike acorn-loose, Esprima is more strict and does not handle syntax errors as gracefully. It is best suited for applications where the input code is expected to be correct.
Espree is the parser that powers ESLint. It is built on top of Acorn and is designed to be used in linting tools. While it can handle some syntax errors, it is generally more strict compared to acorn-loose.
An error-tolerant JavaScript parser written in JavaScript.
This parser will parse any text into an ESTree syntax tree that is a reasonable approximation of what it might mean as a JavaScript program.
It will, to recover from missing brackets, treat whitespace as
significant, which has the downside that it might mis-parse a valid
but weirdly indented file. It is recommended to always try a parse
with the regular acorn
parser first, and only fall back to this
parser when that one finds syntax errors.
Acorn is open source software released under an MIT license.
You are welcome to report bugs or create pull requests on github.
The easiest way to install acorn-loose is from npm
:
npm install acorn-loose
Alternately, you can download the source and build acorn yourself:
git clone https://github.com/acornjs/acorn.git
cd acorn
npm install
parse(input, options)
takes an input string and a set of options
(the same options as
acorn
takes), and returns a syntax tree, even if the code isn't
syntactically valid. It'll insert identifier nodes with name "✖"
as
placeholders in places where it can't make sense of the input. Depends
on the acorn
package, because it uses the same tokenizer.
var acornLoose = require("acorn-loose");
console.log(acornLoose.parse("1 / * 4 )[2]", {ecmaVersion: 2020}));
Like the regular parser, the loose parser supports plugins. You can
take the LooseParser
class exported by the module, and call its
static extend
method with one or more plugins to get a customized
parser class. The class has a static parse
method that acts like the
top-level parse
method.
isDummy(node)
takes a Node
and returns true
if it is a dummy node
inserted by the parser. The function performs a simple equality check on the
node's name.
FAQs
Error-tolerant ECMAScript parser
The npm package acorn-loose receives a total of 1,229,126 weekly downloads. As such, acorn-loose popularity was classified as popular.
We found that acorn-loose demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.